CVE-2021-33360: 
JavaScript vulnerability analysis and mitigation

An issue was discovered in Stoqey gnuplot versions 0.0.3 and earlier that allows attackers to execute arbitrary code. The vulnerability exists in the src/index.ts file, specifically in the plotCallback function, where improper validation of user-supplied data can lead to code execution (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The specific flaw exists within the plotCallback function where parameters such as child_process and filePath are not properly validated before being used in execution contexts (NVD).

The vulnerability allows attackers to execute arbitrary code on affected systems. Due to the critical CVSS score of 9.8, successful exploitation could lead to complete system compromise with high impacts on confidentiality, integrity, and availability (NVD).

The vulnerability is exploitable through the src/index.ts file, specifically targeting the plotCallback function. Proof of concept code has been identified in the source code repository (Github).

Users should upgrade to a version newer than 0.0.3 of Stoqey gnuplot. The vulnerability has been reported and documented in the Checkmarx security advisory (Checkmarx Advisory).