{"id":"CVE-2021-29369","aliases":["EUVD-2022-0968","GHSA-f2jw-pr2c-9x96"],"status":"published","title":"Code injection in @rkesters/gnuplot","description":"The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01776,"percentile":0.78491,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2021-05-03T11:27:22Z","modified":"2026-10-20T10:54:37Z","fixes":[{"ecosystem":"npm","package":"@rkesters/gnuplot","fixed_in":["0.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@rkesters/gnuplot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@rkesters/gnuplot","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}]}],"products":[{"vendor":"gnuplot_project","product":"gnuplot"}],"references":[{"url":"https://www.npmjs.com/package/%40rkesters/gnuplot","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/rkesters/gnuplot/commit/23671d4d3d28570fb19a936a6328bfac742410de","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29369","tags":["advisory"]},{"url":"https://www.npmjs.com/package/@rkesters/gnuplot","tags":["package"]},{"url":"https://github.com/advisories/GHSA-f2jw-pr2c-9x96"}],"sources":{"cve":[{"id":"CVE-2021-29369","description":"The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.","status":"published","published":"2021-05-03T11:27:22Z","modified":"2024-08-03T22:02:51.818Z","updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2022-0968","description":"The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.","status":"published","published":"2021-05-03T11:27:22Z","modified":"2024-08-03T22:02:51Z","updated_at":"2026-11-03T03:24:44.540278Z"}],"ghsa":[{"id":"GHSA-f2jw-pr2c-9x96","title":"Code injection in @rkesters/gnuplot","description":"@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.","status":"published","published":"2022-02-10T23:41:49Z","modified":"2023-02-01T05:06:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2021-29369","description":"The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.","status":"published","published":"2021-05-03T12:15:07.503Z","modified":"2026-06-17T03:47:33.76Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-29369","description":"The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.","status":"published","published":"2021-05-03T12:15:07.503Z","modified":"2026-10-20T10:54:37.407684476Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-f2jw-pr2c-9x96","title":"Code injection in @rkesters/gnuplot","description":"@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.","status":"published","published":"2022-02-10T23:41:49Z","modified":"2023-11-08T04:05:33.225512Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}