Vulnerability in function-plot project

[ankitdn]

While working on function-plot project, I reviewed the dependency manifest and found that it uses a vulnerable version of math-codegen. During analysis, I discovered that user input passed to the cg.parse() function is not properly sanitized and is directly embedded into a new Function() call. This behavior allows attackers to inject arbitrary JavaScript code, leading to remote code execution (RCE) if user-controlled input is evaluated.

CVE Report
CVE Link

[mauriciopoppe]

Thanks, this was reported in GHSA-p6x5-p4xf-cc4r and fixed in mauriciopoppe/math-codegen#11.

The latest function plot release uses the fixed dependencies https://github.com/mauriciopoppe/function-plot/releases/tag/v1.25.4.