CVE-2026-41507: Mauriciopoppe Math-Codegen

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.

Affected products

• Mauriciopoppe Math-Codegen: before 0.4.3 (fixed in 0.4.3)

Published 2026-05-08. Last modified 2026-06-17.