Description
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.0.2
References
Could your website be exposed too?
SmartScanner can check your website for expr-eval does not restrict functions passed to the evaluate function - expr-eval and gives you actionable findings to investigate.
Start a free scanRelated Issues
- expr-eval does not restrict functions passed to the evaluate function - CVE-2025-12735
- expr-eval vulnerable to Prototype Pollution - expr-eval - CVE-2025-13204
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - CVE-2025-53892
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - vue-i18n - CVE-2025-53892
You might also like:
See something that needs correcting? Let us knowUpdated December 09, 2025