GHSA-cfwc-xjfp-44jg: 
JavaScript vulnerability analysis and mitigation

A critical command injection vulnerability was identified in the gnuplot npm package (GHSA-cfwc-xjfp-44jg). The vulnerability affects all versions of the package and was discovered and published to the GitHub Advisory Database on September 4, 2020, with the latest update on January 9, 2023. This security issue impacts all versions of the gnuplot package (>=0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability stems from the package's failure to properly sanitize plot titles, which creates a command injection vulnerability (CWE-77). When title values are supplied by users, attackers can potentially execute arbitrary system commands. A proof-of-concept demonstrates that by manipulating the title parameter with a specially crafted string containing system commands, arbitrary code execution is possible (GitHub Advisory).

The vulnerability has been classified as Critical severity. If exploited, attackers can execute arbitrary system commands through the gnuplot package, potentially leading to complete system compromise when the title value is user-controlled (GitHub Advisory, NPM Advisory).

A proof-of-concept exploit exists that demonstrates the vulnerability by creating a test file in the current directory using a maliciously crafted title parameter. The exploit leverages the unsanitized title input to execute system commands through the gnuplot package (GitHub Advisory).

Currently, no fix is available for this vulnerability. The recommended mitigation strategy is to consider using an alternative package until a security fix is made available (GitHub Advisory).