Code injection in @rkesters/gnuplot

CRITICO 9.8CVE-2021-29369 · GHSA-f2jw-pr2c-9x96 · Published 03/05/2021 · updated 17/06/2026

In breve

CVE-2021-29369 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda gnuplot (gnuplot project), @rkesters/gnuplot.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 78.3% delle vulnerabilità.
Correzione: aggiornare a 0.1.0, 0.1.1 o successiva.

Package	Affected versions	Patched versions
gnuplot gnuplot_project	`< 0.1.0`	`0.1.0`
@rkesters/gnuplot npm	`< 0.1.1`	`0.1.1`

Description

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

NVD description

The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

References

nvd.nist.gov/vuln/detail/CVE-2021-29369 · ADVISORY
rkesters/gnuplot commit 23671d4 · WEB
npmjs.com/package/@rkesters/gnuplot · PACKAGE
npmjs.com/package/%40rkesters/gnuplot

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free