CVE-2025-12735
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
- CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-25)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jorenbroekema:javascript_expression_evaluator
- silentmatt:javascript_expression_evaluator
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jc85-fpwf-qm7x | npm | expr-eval | <=2.0.2 | no fix published |
| GHSA-jc85-fpwf-qm7x | npm | expr-eval-fork | <3.0.1 | 3.0.1 |