Vulnerability · Published Nov 5, 2025 · Assigned by certcc
CVE-2025-12735CVE-2025-12735
Critical 9.8
In plain English
A critical-severity security flaw in expr-eval-fork from expr-eval-fork. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | expr-eval | no fix listed | GHSA-jc85-fpwf-qm7x |
| npm | expr-eval-fork | 3.0.1 | GHSA-jc85-fpwf-qm7x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| silentmatt | expr-eval | 0 – through 2.0.2 |
| expr-eval-fork | expr-eval-fork | 0 – through 3.0.0 |
References
- https://github.com/silentmatt/expr-eval
- https://github.com/jorenbroekema/expr-eval
- https://www.npmjs.com/package/expr-eval-fork
- https://www.npmjs.com/package/expr-eval
- https://github.com/silentmatt/expr-eval/pull/288
- Github Security Advisory third-party-advisory
- CERT/CC Advisory third-party-advisory
- https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js exploit
- https://www.kb.cert.org/vuls/id/263614