Vulnerability · Published Jun 23, 2026 · Assigned by snyk

CVE-2026-12866

Critical 9.8

In plain English

A critical-severity code injection in expr-eval. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.9%top 41.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.webjars.npm:expr-eval	no fix listed	GHSA-q9v2-7m5w-4693
npm	expr-eval	no fix listed	GHSA-q9v2-7m5w-4693

Affected products (as reported)

Vendor	Product	Versions
n/a	expr-eval	0 – before *
n/a	org.webjars.npm:expr-eval	0 – before *

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References