Executive brief
expr-eval is a popular JavaScript library for safely evaluating mathematical and logical expressions. A prototype pollution vulnerability allows attackers with access to the eval interface to manipulate JavaScript's prototype chain and achieve arbitrary code execution, potentially compromising systems that rely on this library for expression evaluation.
Technical details
expr-eval is vulnerable to prototype pollution (CWE-1321), a vulnerability in JavaScript's prototype-based inheritance model. An attacker with access to the expression evaluation interface can inject specially crafted payloads that manipulate the __proto__, prototype, or constructor properties to pollute the global object prototype. This enables arbitrary code execution in the context of the application. The vulnerability affects all versions of expr-eval up to and including 2.0.2, and is fixed in expr-eval-fork 2.0.2. The attack requires network access to the eval interface but no authentication, and the fix involves adding explicit checks to reject variable names matching /^__proto__|prototype|constructor$/.
Affected products
- expr-eval up to 2.0.2
Timeline
- 2025-11-14: disclosed
- 2025-11-17: patched: Fixed in expr-eval-fork 2.0.2