CVE-2026-41507: math-codegen RCE Exposes Apps to Arbitrary Command Execution
The National Vulnerability Database has disclosed CVE-2026-41507, a critical vulnerability in math-codegen (versions prior to 0.4.3). This library, designed to generate code from mathematical expressions, is susceptible to a severe code injection flaw. Specifically, string literal content passed to cg.parse() is injected verbatim into a new Function() body without any sanitization. This oversight creates a direct path for attackers to execute arbitrary system commands.
Any application that exposes a math evaluation endpoint where user-controlled input flows into cg.parse() is at extreme risk. The vulnerability allows for full Remote Code Execution (RCE), giving attackers complete control over affected systems. The National Vulnerability Database assigns a CVSS score of 9.8 (Critical) to this issue, underscoring its severity and ease of exploitation.
The core problem is a classic CWE-94 (Improper Control of Generation of Code (‘Code Injection’)). The fix, available in math-codegen version 0.4.3, addresses this by properly sanitizing input before code generation. Defenders must prioritize patching to prevent unauthenticated attackers from leveraging this flaw for complete system compromise.
What This Means For You
- If your applications or services utilize `math-codegen` for expression parsing, you must immediately verify your version. Any instance running `math-codegen` prior to version 0.4.3, especially if exposed to untrusted input, is a ticking time bomb. Prioritize patching to version 0.4.3 or later to mitigate the critical RCE risk posed by CVE-2026-41507. Audit all endpoints that pass user input to `cg.parse()`.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-41507: math-codegen RCE via Function constructor injection
title: CVE-2026-41507: math-codegen RCE via Function constructor injection
id: scw-2026-05-08-ai-1
status: experimental
level: critical
description: |
Detects exploitation attempts against CVE-2026-41507 by looking for web requests to a typical math evaluation endpoint ('/math') containing 'eval' and a suspicious JavaScript payload pattern ('new Function(\'') within the query string. This indicates an attempt to inject arbitrary JavaScript code that can lead to RCE via the vulnerable math-codegen library.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-41507/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/math'
cs-uri-query|contains:
- 'eval'
cs-uri-query|contains:
- 'new Function(\''
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41507 | RCE | math-codegen < 0.4.3 |
| CVE-2026-41507 | Code Injection | math-codegen cg.parse() function |
| CVE-2026-41507 | RCE | Applications exposing math evaluation endpoint using math-codegen |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 08, 2026 at 17:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...