logo

Database

Remote command execution In expr-eval

Description

expr-eval does not restrict functions passed to the evaluate function The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2025-127352. NVD-2025-127353. OSV-2025-127354. GCVE-2025-12735

References

1. https://github.com/silentmatt/expr-eval/pull/2882. https://github.com/silentmatt/expr-eval/pull/2893. https://github.com/jorenbroekema/expr-eval/commit/1d71bb2ca8f98df8de00e9cc4de8fdd468a7ad434. https://github.com/jorenbroekema/expr-eval5. https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js6. https://github.com/silentmatt/expr-eval7. https://kb.cert.org/vuls/id/2636148. https://www.kb.cert.org/vuls/id/2636149. https://www.npmjs.com/package/expr-eval10. https://www.npmjs.com/package/expr-eval-fork11. https://github.com/alnashawatirohwederb2167-max/cve-2025-12735-expr-eval-rce

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.