Code injection in @rkesters/gnuplot

CRITICAL 9.8CVE-2021-29369 · GHSA-f2jw-pr2c-9x96 · Published 03/05/2021 · updated 17/06/2026

In short

CVE-2021-29369 is a CRITICAL (CVSS 9.8) vulnerability affecting gnuplot (gnuplot project), @rkesters/gnuplot.
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.3% of all vulnerabilities.
Fix: update to 0.1.0, 0.1.1 or later.

Package	Affected versions	Patched versions
gnuplot gnuplot_project	`< 0.1.0`	`0.1.0`
@rkesters/gnuplot npm	`< 0.1.1`	`0.1.1`

Description

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

NVD description

The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

References

nvd.nist.gov/vuln/detail/CVE-2021-29369 · ADVISORY
rkesters/gnuplot commit 23671d4 · WEB
npmjs.com/package/@rkesters/gnuplot · PACKAGE
npmjs.com/package/%40rkesters/gnuplot

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free