CVE-2026-41507: Remote Code Execution via String Literal Injection in math-codegen
math-codegen versions before 0.4.3 inject string literal content passed to cg.parse() into generated code without sanitization, which the record classifies as code injection (CWE-94). The record rates the issue critical with a CVSS 3.1 base score of 9.8 and reports a patch in version 0.4.3. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-41507 affects math-codegen, a library that generates code from mathematical expressions. According to the record, string literal content passed to cg.parse() is placed without sanitization into code later built with new Function(), which is classified as CWE-94 (Code Injection).
Impact
The record states that an attacker could execute arbitrary system commands when user-controlled input reaches the parser. Applications exposing a math evaluation endpoint where user input flows into cg.parse() are described as vulnerable to full remote code execution. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with a base score of 9.8, reported by GitHub as the CNA and the security-advisories provider in the record.
Affected products and versions
- Mauriciopoppe Math-codegen before 0.4.3
The record lists the affected range as versions below 0.4.3, with the patched release being 0.4.3.
Exploitation status
This CVE is not listed in the CISA KEV catalogue in the record. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none and automatable as yes, and the EPSS probability is 0.00672 with a percentile of 0.51507.
Remediation and mitigation
- Upgrade math-codegen to version 0.4.3, which the record identifies as the patched release.
- Review the patch commit and the vendor advisory listed in the references.
- Until the upgrade is complete, do not pass untrusted input to the parser and restrict math evaluation endpoints to authenticated, trusted users where feasible.
- Validate input against a strict expression grammar before it reaches the library and run the service with least privilege.
Detection guidance
- Inventory applications and dependencies that use math-codegen and record their installed versions.
- Review logs for math evaluation endpoints for unusual or unexpected input patterns, without exposing sensitive data.
- Monitor for unexpected child processes or outbound activity from services that evaluate expressions.
Limitations of the available information
The record does not describe the exact input format needed to trigger the issue, the number of affected deployments, or any independent testing. The affected version list contains two equivalent entries. EPSS and SSVC values are reported as recorded and may change over time.
Frequently asked questions
Is there a fix for CVE-2026-41507?
The record states the issue was patched in version 0.4.3 of math-codegen. Upgrading to that version or later is the recommended remediation.
Is this vulnerability being actively exploited?
This CVE is not listed in the CISA KEV catalogue in the record, and no confirmed exploitation appears in the sources consulted.
Which applications are at risk?
Applications using math-codegen before 0.4.3 where user-controlled input reaches cg.parse() are described as vulnerable. Limiting untrusted input to the parser reduces exposure.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.