Skip to content
OpenAdvisories

Package · npm

expr-eval-fork

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2025-13204

    CVE-2025-13204

    npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.

    silentmatt expr-eval expr-eval expr-eval-fork npm
  • Critical 9.8
    CVE-2025-12735 Public exploit

    CVE-2025-12735

    The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER …

    silentmatt expr-eval-fork expr-eval expr-eval-fork npm