Description
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| silentmatt | expr-eval | ≤ 2.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.2 AUS | grafana-pcp | 1.0.5-5.el8_2 | RHSA-2026:0140 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | expr-eval | <= 2.0.2 | — | GHSA-8gw3-rxh4-v6jx |
| npm | expr-eval-fork | < 2.0.2 | 2.0.2 | GHSA-8gw3-rxh4-v6jx |
Advisories 2
- RHSA-2026:0140 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Apr 16, 2026
- WID-SEC-2026-0021 Red Hat Enterprise Linux (npm expr-eval): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jan 6, 2026
References
- https://www.npmjs.com/package/expr-eval-fork
- https://github.com/silentmatt/expr-eval
- https://github.com/jorenbroekema/expr-eval
- https://www.huntr.dev/bounties/1-npm-expr-eval/ third-party-advisory
- https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py
- https://github.com/silentmatt/expr-eval/pull/252/files patch
- https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py exploit