expr-eval vulnerabilities

2 known vulnerabilities in expr-eval from Silentmatt. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  expr-eval: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2025-13204Nov 14, 2025Silentmatt

  npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.

• 9.8 Critical severity

  expr-eval: Improper Control of Generation of Code

  CVE-2025-12735Nov 5, 2025SilentmattEPSS 1.76%

  The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER o