Executive brief
math-codegen is a library used to convert mathematical expressions into executable code. A security flaw allows attackers to inject malicious commands into these expressions, which the library then executes on the underlying server. This could lead to a complete system takeover, unauthorized data access, or service disruption for any application using this library to process user-provided math formulas.
Technical details
A code injection vulnerability (CWE-94) exists in math-codegen prior to version 0.4.3. The root cause is that string literal content passed to the `cg.parse()` method is injected verbatim into a `new Function()` constructor without proper sanitization or escaping. An attacker can exploit this by submitting a crafted mathematical expression containing JavaScript payloads. If the application exposes an endpoint that passes user-controlled input to the parser, the attacker can achieve full remote code execution (RCE) on the host environment. The issue was resolved in version 0.4.3 by implementing `JSON.stringify()` to properly escape string literals in `ConstantNode.js` and other relevant nodes.
Affected products
- mauriciopoppe math-codegen < 0.4.3
Timeline
- 2026-04-09: patched: Fix merged in pull request #11
- 2026-04-16: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE-2026-41507 published to NVD