3vulnerabilities
- Critical1 (33.3%)
- High2 (66.7%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
expr-eval
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting expr-eval, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-q9v2-7m5w-4693 | Critical | expr-eval vulnerable to Code ExecutionAll versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context. |
| GitHub (opens in a new tab) | |
| GHSA-8gw3-rxh4-v6jx | High | expr-eval vulnerable to Prototype Pollutionnpm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue. |
| GitHub (opens in a new tab) | |
| GHSA-jc85-fpwf-qm7x | High | expr-eval does not restrict functions passed to the evaluate functionThe expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution. |
| GitHub (opens in a new tab) |
- GHSA-q9v2-7m5w-4693Criticalexpr-eval vulnerable to Code Execution
<= 2.0.2
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.
CVE: CVE-2026-12866
- GHSA-8gw3-rxh4-v6jxHighexpr-eval vulnerable to Prototype Pollution
<= 2.0.2
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
CVE: CVE-2025-13204
- GHSA-jc85-fpwf-qm7xHighexpr-eval does not restrict functions passed to the evaluate function
<= 2.0.2
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.
CVE: CVE-2025-12735