See how gnuplot project compares to other vendors in security performance
The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
comline() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.
gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest().
An uninitialized stack variable vulnerability in loadticseries() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.
gnuplot 5.5 is affected by double free when executing printsetoutput. This may result in context-dependent arbitrary code execution.