Skip to content

Product

org.webjars.npm/expr-eval vulnerabilities

1 published CVE affecting org.webjars.npm/expr-eval, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
1
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest org.webjars.npm/expr-eval CVEs

Newest publication first

  1. CVE-2026-12866 expr-eval vulnerable to Code Execution

    Published
    CriticalCVSS 9.2 EPSS 0.87%

    All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transf...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.