stoqey/gnuplot is vulnerable to command injection

CRITICAL 9.8CVE-2021-33360 · GHSA-795w-7426-m94j · Published 10/03/2023 · updated 17/06/2026

In short

CVE-2021-33360 is a CRITICAL (CVSS 9.8) vulnerability affecting gnuplot (stoqey), @stoqey/gnuplot.
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
gnuplot stoqey	`≤ 0.0.3`	No fix yet
@stoqey/gnuplot npm	`≤ 0.0.3`	No fix yet

Description

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

NVD description

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

References

nvd.nist.gov/vuln/detail/CVE-2021-33360 · ADVISORY
advisory.checkmarx.net/advisory/CX-2021-4811 · WEB
stoqey/gnuplot · PACKAGE
stoqey/gnuplot · WEB
advisory.checkmarx.net/advisory/CX-2021-4811 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free