CVE-2025-12735
CVE-2025-12735
- State
- Published
- Severity
- 9.8 Critical
- Published
- Nov 5, 2025
- Updated
- Nov 22, 2025
- Reserved
- Nov 5, 2025
Description
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
expr-evalsilentmatt |
|
expr-eval-forkexpr-eval-fork |
|
References
- https://github.com/silentmatt/expr-eval
- https://github.com/jorenbroekema/expr-eval
- https://www.npmjs.com/package/expr-eval-fork
- https://www.npmjs.com/package/expr-eval
- https://github.com/silentmatt/expr-eval/pull/288
- Github Security Advisorythird-party-advisory
- CERT/CC Advisorythird-party-advisory
- https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.jsexploit
- https://www.kb.cert.org/vuls/id/263614
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.