Skip to content
OpenAdvisories

Package · npm

expr-eval

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.8
    CVE-2026-12866

    expr-eval vulnerable to Code Execution

    All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled e…

    expr-eval org.webjars.npm:expr-eval npm Maven
  • Critical 9.8
    CVE-2025-13204

    CVE-2025-13204

    npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.

    silentmatt expr-eval expr-eval expr-eval-fork npm
  • Critical 9.8
    CVE-2025-12735 Public exploit

    CVE-2025-12735

    The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER …

    silentmatt expr-eval-fork expr-eval expr-eval-fork npm