CVE-2025-12735

Published
View on NVD ↗
CVSS v3
9.8
CRITICAL
CVSS v2
N/A
Affected
4
PROJECTS

Description

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

expr-eval
expr-eval
Mathematical expression evaluator
NPMNPM
silentmatt/expr-eval
silentmatt/expr-eval
Mathematical expression evaluator in JavaScript
GitHubGitHub
1.34K
jorenbroekema/expr-eval
jorenbroekema/expr-eval
Mathematical expression evaluator in JavaScript
GitHubGitHub
7
expr-eval-fork
expr-eval-fork
Mathematical expression evaluator fork with exports map, prototype pollution and code injection security fixes
NPMNPM