Description
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.
Recommendation
Update the expr-eval-fork package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.0
- Patched version(s): 3.0.1
References
Could your website be exposed too?
SmartScanner can check your website for expr-eval does not restrict functions passed to the evaluate function and gives you actionable findings to investigate.
Start a free scanRelated Issues
- expr-eval does not restrict functions passed to the evaluate function - expr-eval - CVE-2025-12735
- expr-eval vulnerable to Prototype Pollution - CVE-2025-13204
- expr-eval vulnerable to Prototype Pollution - expr-eval - CVE-2025-13204
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - CVE-2025-53892
You might also like:
See something that needs correcting? Let us knowUpdated December 09, 2025