Executive brief
The expr-eval library, a tool used to evaluate mathematical expressions in applications, is vulnerable to a flaw that allows attackers to run unauthorized code. By providing specially crafted input to the expression evaluator, an attacker can bypass security restrictions and execute arbitrary commands on the underlying server. This could lead to a complete system takeover, theft of sensitive data, or disruption of services.
Technical details
The expr-eval package is vulnerable to Code Injection (CWE-94) via the toJSFunction() API. The root cause is the use of the 'new Function()' constructor to compile user-supplied expressions into native JavaScript. During this process, variable values are coerced via toString() and concatenated into the function body without sufficient sanitization or isolation. In Node.js environments, an attacker can provide an object with a custom toString() method that returns malicious code, allowing them to access Node globals like 'process' to perform file system operations or execute shell commands. As of the advisory date, no fixed version is available.
Affected products
- silentmatt expr-eval All versions
Timeline
- 2026-01-20: disclosed: Vulnerability reported via GitHub issue
- 2026-06-22: advisory: Snyk published advisory
- 2026-06-23: disclosed: CVE published to NVD