stoqey/gnuplot is vulnerable to command injection

KRITISCH 9.8CVE-2021-33360 · GHSA-795w-7426-m94j · Published 10/03/2023 · updated 17/06/2026

Kurz gesagt

CVE-2021-33360 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in gnuplot (stoqey), @stoqey/gnuplot.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 66.6% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
gnuplot stoqey	`≤ 0.0.3`	No fix yet
@stoqey/gnuplot npm	`≤ 0.0.3`	No fix yet

Description

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

NVD description

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

References

nvd.nist.gov/vuln/detail/CVE-2021-33360 · ADVISORY
advisory.checkmarx.net/advisory/CX-2021-4811 · WEB
stoqey/gnuplot · PACKAGE
stoqey/gnuplot · WEB
advisory.checkmarx.net/advisory/CX-2021-4811 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free