The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Fix
Public exploits 3
- AN5I/cve-2025-12735-expr-eval-rce PoC on GitHub
- alecasg555/safe-expr-eval PoC on GitHub
- alnashawatirohwederb2167-max/cve-2025-12735-expr-eval-rce PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/silentmatt/expr-eval/pull/288 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · jorenbroekema, silentmattNVD modified 2026-10-18 21:10
Affected (CPE criteria) 2
cpe:2.3:a:jorenbroekema:javascript_expression_evaluator:3.0.0:*:*:*:*:node.js:*:*cpe:2.3:a:silentmatt:javascript_expression_evaluator:*:*:*:*:*:node.js:*:*
References 9
- https://github.com/advisories/GHSA-jc85-fpwf-qm7x Third Party Advisory
- https://github.com/jorenbroekema/expr-eval Product
- https://github.com/silentmatt/expr-eval Product
- https://github.com/silentmatt/expr-eval/pull/288 Issue Tracking, Patch
- https://kb.cert.org/vuls/id/263614 Third Party Advisory
- https://www.npmjs.com/package/expr-eval Product
- https://www.npmjs.com/package/expr-eval-fork Product
- https://www.kb.cert.org/vuls/id/263614 Third Party Advisory
- https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js Product