expr-eval does not restrict functions passed to the evaluate function - expr-eval

Description

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.0.2

References

• GHSA-jc85-fpwf-qm7x
• www.npmjs.com
• www.kb.cert.org
• kb.cert.org
• CVE-2025-12735
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• expr-eval does not restrict functions passed to the evaluate function - CVE-2025-12735
• expr-eval vulnerable to Prototype Pollution - expr-eval - CVE-2025-13204
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - CVE-2025-53892
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - vue-i18n - CVE-2025-53892

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

expr-eval