Unsanitized Code Generation Enables Remote Code Execution

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The math-codegen library prior to version 0.4.3 contains a critical code injection vulnerability (CWE-94) where mathematical expressions are converted directly into JavaScript Function() bodies without sanitization. Attackers can inject arbitrary code through user-controlled mathematical input, achieving unauthenticated remote code execution on systems running vulnerable versions. This affects any application that exposes math evaluation functionality to untrusted users—including educational platforms, scientific computing tools, and API endpoints—creating a direct path from user input to system command execution with CVSS 9.8 severity.

Casky.ai maps this vulnerability pattern across 301 security skills tied to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) behaviors. Practitioners using Casky would identify detection signals including: code injection attempts in parser logs showing shell metacharacters or Function() syntax in mathematical expressions; process execution anomalies where the application spawns unexpected child processes; and data exfiltration patterns when injected payloads attempt command execution. Claude's extended reasoning capability helps practitioners correlate these signals—recognizing that benign-looking mathematical input (e.g., "1+1; exec('rm -rf');") represents exploitation attempts—and trace the attack chain from initial reconnaissance through code execution, enabling rapid response before attackers achieve persistence or lateral movement.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-41507.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-41507

Casky has 301 skills that investigate the attack patterns behind CVE-2026-41507. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn