The vulnerability exists in math‑codegen, a library that translates mathematical expressions into executable code. Prior to version 0.4.3 the library concatenates the string literal content passed to cg.parse() directly into the body of a new Function() without sanitization. This omission permits an attacker to inject arbitrary code through user‑controlled expressions, causing the Function to execute system commands on the host. The flaw is a classic code injection leading to full Remote Code Execution, as reflected in the high CVSS score of 9.8.

Affected systems are any installations of math‑codegen before 0.4.3. Applications that expose a math evaluation endpoint and forward user input to cg.parse() are vulnerable. The vendor product is mauriciopoppe math‑codegen; the vulnerable range is all releases prior to 0.4.3, with the patch applied in 0.4.3.

The risk is high due to the high CVSS; no EPSS value is published, but the severity suggests a strong likelihood of exploitation in the wild. The flaw is not listed in CISA KEV, which indicates no known active exploitation yet, but the attack path is straightforward: an attacker supplies a crafted mathematical expression that contains JavaScript code, the library injects it into a Function, and the host executes the code. Therefore, any system that uses the vulnerable library without input validation is at risk of arbitrary command execution.