9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41507

CVE-2026-41507: Remote Code Execution (RCE) via String Literal Injection into math-codegen

Impact

String literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE.

Patches

The vulnerability is addressed by using JSON.stringify() on string literal values in lib/node/ConstantNode.js to ensure they are treated as data rather than code. Users should upgrade to version 0.4.3 or later.

Workarounds

Avoid passing un-sanitized user input to the parser or manually escape string literals in the input.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41507

CVE-2026-41507:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
math-codegen	npm	< 0.4.3	0.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a code injection flaw in the math-codegen library. The core of the issue lies in the insecure construction of JavaScript code from a parsed math expression. The cg.parse() method and its underlying components generate code that is then executed via new Function(). The vulnerability arises because user-controlled input, particularly string literals and identifiers, was not properly sanitized before being embedded into the generated code.

The patch, identified in commit 4bb52d3030683362b3559ee8dd91350555a05f6b, addresses this by consistently applying JSON.stringify() to all external data being incorporated into the code string. This ensures that values are treated as data (e.g., a literal string) rather than as executable code.

The most critical point of injection was within lib/node/ConstantNode.js, where string literals were directly concatenated. This allowed an attacker to close the string, inject arbitrary commands, and achieve Remote Code Execution (RCE). The same commit also fixed similar, albeit less direct, injection vulnerabilities in other node handlers (AssignmentNode, FunctionNode, SymbolNode) where identifiers were not escaped, demonstrating a systemic issue of improper code generation. The analysis identifies all functions that were modified to safely handle input, as they were all part of the attack surface.

Vulnerable functions

module.exports

lib/node/ConstantNode.js

This function, which is the main export of the 'lib/node/ConstantNode.js' module, is responsible for processing constant nodes in the abstract syntax tree. The vulnerability lies in the fact that for nodes of type 'string', the 'node.value' was directly concatenated into the generated code string. This allows an attacker to inject arbitrary JavaScript by crafting a malicious string literal. The patch mitigates this by using 'JSON.stringify()' to properly escape the string value, ensuring it is treated as a literal string and not executable code.

CodeGenerator.prototype.compile

lib/CodeGenerator.js

This function is responsible for compiling the generated code into a JavaScript function. The patch adds an extra layer of security by applying 'JSON.stringify()' to the entire code string. While the primary vulnerability is in the node-specific handlers, this change in the 'compile' function serves as a defense-in-depth measure to prevent code injection.

module.exports

lib/node/AssignmentNode.js

This function, the main export of 'lib/node/AssignmentNode.js', handles assignment expressions. The vulnerability existed because 'node.name', representing the variable being assigned to, was not sanitized. A malicious 'node.name' could be used to inject code. The patch fixes this by using 'JSON.stringify()' to escape the name.

functionProxy

lib/node/FunctionNode.js

This function creates a proxy for function calls. The function's name, 'node.name', was concatenated into the generated code as a string literal without proper escaping. This created a potential vector for code injection. The patch addresses this by using 'JSON.stringify()' on the function name.

module.exports

lib/node/SymbolNode.js

This function, the main export of 'lib/node/SymbolNode.js', processes symbol nodes (variables). The symbol's name ('id', derived from 'node.name') was not sanitized before being included in the generated code. This could allow for code injection through a maliciously crafted symbol name. The patch mitigates this by using 'JSON.stringify()'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.