critical9.8
CVE-2021-29369
Code injection in @rkesters/gnuplot
Impact
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @rkesters/gnuplot | < 0.1.1 | 0.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnuplot Project | Gnuplot | before 0.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/rkesters/gnuplot/commit/23671d4d3d28570fb19a936a6328bfac742410de
- https://www.npmjs.com/package/%40rkesters/gnuplot
- https://github.com/advisories/GHSA-f2jw-pr2c-9x96
- https://nvd.nist.gov/vuln/detail/CVE-2021-29369
- https://www.npmjs.com/package/@rkesters/gnuplot