expr-eval does not restrict functions passed to the evaluate function

Description

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.

Recommendation

Update the expr-eval-fork package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.0.0
• Patched version(s): 3.0.1

References

• GHSA-jc85-fpwf-qm7x
• www.npmjs.com
• www.kb.cert.org
• kb.cert.org
• CVE-2025-12735
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• expr-eval does not restrict functions passed to the evaluate function - expr-eval - CVE-2025-12735
• expr-eval vulnerable to Prototype Pollution - CVE-2025-13204
• expr-eval vulnerable to Prototype Pollution - expr-eval - CVE-2025-13204
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - CVE-2025-53892

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

expr-eval-fork