CVE-2026-41507

Description

### Impact String literal content passed to `cg.parse()` is injected verbatim into a `new Function()` body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into `cg.parse()` is vulnerable to full RCE. ### Patches The vulnerability is addressed by using `JSON.stringify()` on string literal values in `lib/node/ConstantNode.js` to ensure they are treated as data rather than code. Users should upgrade to version 0.4.3 or later. ### Workarounds Avoid passing un-sanitized user input to the parser or manually escape string literals in the input.

How to fix CVE-2026-41507

To remediate CVE-2026-41507, upgrade the affected package to a fixed version below.

• —upgrade to 0.4.3 or later

Is CVE-2026-41507 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.4.3

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-41507
• PATCHgithub.com/mauriciopoppe/math-codegen
• WEBgithub.com/hits3134
• WEBgithub.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b
• WEB