Skip to content

Product

npm expr-eval vulnerabilities

3 published CVES affecting npm expr-eval, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
3
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest npm expr-eval CVEs

Newest publication first

  1. CVE-2026-12866 expr-eval vulnerable to Code Execution

    Published
    CriticalCVSS 9.2

    All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transf...

  2. CVE-2025-13204 CVE-2025-13204

    Published
    CriticalCVSS 9.8

    npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.

  3. CVE-2025-12735 CVE-2025-12735

    Published
    CriticalCVSS 9.8

    The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.