Executive brief
expr-eval is a JavaScript library used to safely evaluate mathematical expressions. An attacker can bypass input validation by passing a crafted variables object to the evaluate() function, leading to arbitrary code execution on the server or client where the library is used.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the expr-eval library's evaluate() function. The library fails to properly validate and restrict functions passed through the variables parameter, allowing an attacker to inject and execute arbitrary code. The attack vector is local or network-dependent on how the application uses the library—if the evaluate() function is called with user-controlled input without additional validation, an attacker can craft a malicious variables object to achieve remote code execution. Patches have been proposed in pull requests #288 and #289 on the upstream repository, and a fix is available in expr-eval-fork version 3.0.1 and later.
Affected products
- expr-eval expr-eval 0 through 2.0.2
- expr-eval expr-eval-fork 0 through 3.0.0
Timeline
- 2025-11-05: disclosed: Published as GHSA-jc85-fpwf-qm7x
- 2025-11-05: advisory: CVE-2025-12735 assigned