The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

comline() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, childprocess, and/or filePath parameter(s).

gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest().

An uninitialized stack variable vulnerability in loadticseries() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.

gnuplot 5.5 is affected by double free when executing printsetoutput. This may result in context-dependent arbitrary code execution.

A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash.

gnuplot 6.1 is affected by SEGV when executing function xstrftime. This may result in local code execution.

gnuplot 6.1 is affected by SEGV when executing function X11graphics. This may result in local code execution.

gnuplot 6.1 is affected by SEGV when executing function plot3dpoints. This may result in local code execution.

gnuplot 6.1 is affected by SEGV when executing function CANVAStext. This may result in local code execution.

gnuplot 6.1 is affected by SEGV when executing function GetAnnotateString. This may result in local code execution.

A flaw was found in GNUPlot. A segmentation fault via IOstrinitstaticinternal may jeopardize the environment.

gnuplot 6.1 is affected by heap-buffer-overflow when executing function utf8copyone. This may result in local code execution.