GHSA-795w-7426-m94j

stoqey/gnuplot is vulnerable to command injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-33360

Packages

Ecosystem	Package	Affected	Fixed in
npm	@stoqey/gnuplot	<= 0.0.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33360 advisory
https://advisory.checkmarx.net/advisory/CX-2021-4811 web
https://github.com/stoqey/gnuplot package
https://github.com/stoqey/gnuplot/blob/cd76060a15f58348baeef1c5fd867ce856515949/src/index.ts#L211-L217 web