CyberSecBulletin

Org.webjars.npm:expr-eval vulnerabilities

We track 1 vulnerability in Org.webjars.npm:expr-eval products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2026.

1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score

Latest Org.webjars.npm:expr-eval vulnerabilities

  • 9.8 Critical severity

    expr-eval: Improper Control of Generation of Code

    CVE-2026-12866Expr-eval

    All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled ex