stoqey/gnuplot is vulnerable to command injection

CRITICO 9.8CVE-2021-33360 · GHSA-795w-7426-m94j · Published 10/03/2023 · updated 17/06/2026

In breve

CVE-2021-33360 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda gnuplot (stoqey), @stoqey/gnuplot.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 66.6% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
gnuplot stoqey	`≤ 0.0.3`	No fix yet
@stoqey/gnuplot npm	`≤ 0.0.3`	No fix yet

Description

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

NVD description

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

References

nvd.nist.gov/vuln/detail/CVE-2021-33360 · ADVISORY
advisory.checkmarx.net/advisory/CX-2021-4811 · WEB
stoqey/gnuplot · PACKAGE
stoqey/gnuplot · WEB
advisory.checkmarx.net/advisory/CX-2021-4811 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free