expr-eval vulnerable to Code Execution

Description

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function().

Recommendation

No fix is available yet. Followings are affected versions:

<= 2.0.2

References

GHSA-q9v2-7m5w-4693
security.snyk.io
CVE-2026-12866
CWE-94
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for expr-eval vulnerable to Code Execution and gives you actionable findings to investigate.

Start a free scan

Related Issues

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions - CVE-2026-77415
expr-eval vulnerable to Prototype Pollution - expr-eval - CVE-2025-13204
LiquidJS is Vulnerable to Remote Code Execution - CVE-2026-45618
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions - jsonata - CVE-2026-77414

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated September 22, 2026