cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

safe-expr-eval

safe-expr-eval Fast and lightweight expression evaluator for JavaScript and TypeScript. A modern expression parser with a familiar API, zero dependencies, and full TypeScript support. Features Fast expression parsing and evaluation Lightweight and dependency-free Full TypeScript support Simple an...

ROOT-APP-NPM-CVE-2026-12866 CVE-2026-12866 in expr-eval - Patched by Root

Root has patched CVE-2026-12866 in the expr-eval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-12735 CVE-2025-12735 in expr-eval - Patched by Root

Root has patched CVE-2025-12735 in the expr-eval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-13204 CVE-2025-13204 in expr-eval - Patched by Root

Root has patched CVE-2025-13204 in the expr-eval package for Root:npm. Multiple fixed versions available...

CLSA-2026-1774830287 TuxCare security update for expr-eval (2 CVEs)

TuxCare rebuilt expr-eval to address 2 CVEs. Fixed in 2.0.2-tuxcare.1...

PT-2026-74219

TuxCare rebuilt expr-eval to address 2 CVEs. Fixed in 2.0.2-tuxcare.1...

CVE-2026-12866

A flaw was found in expr-eval. A remote attacker can exploit this vulnerability by supplying crafted expressions to the toJSFunction API. These expressions are then compiled into native code using new Function, allowing the attacker to execute arbitrary JavaScript code. This can lead to arbitrary...

10minions-engine (>=0.0.1, <=0.0.4), 3ui (>=0.1.0, <=0.1.8) +2123 more potentially affected by CVE-2026-12866 via expr-eval (2.0.2)

expr-eval NPM version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on expr-eval and may be impacted: - 10minions-engine =0.0.1, =0.1.0, =1.0.2, =1.2.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.4, =0.1.5 -...

10minions-engine (>=0.0.1, <=0.0.4), 3ui (>=0.1.0, <=0.1.8) +2123 more potentially affected by CVE-2026-12866 via expr-eval (2.0.2)

expr-eval NPM version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on expr-eval and may be impacted: - 10minions-engine =0.0.1, =0.1.0, =1.0.2, =1.2.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.4, =0.1.5 -...

expr-eval vulnerable to Code Execution

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...

GHSA-Q9V2-7M5W-4693 expr-eval vulnerable to Code Execution

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...

CVE-2026-12866

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...

CVE-2026-12866

The CVE-2026-12866 entry concerns the npm package expr-eval. Affected versions are vulnerable to Code Execution via the toJSFunction() API, where user-supplied expressions are transformed into executable JavaScript with new Function(), allowing an attacker to escape the sandbox and run arbitrary ...

CVE-2026-12866

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...

CVE-2026-12866

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...

CVE-2026-12866: Improper Control of Generation of Code

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...

PT-2026-51474

Name of the Vulnerable Software and Affected Versions expr-eval affected versions not specified Description Code Execution is possible via the 'toJSFunction' API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function...

Code Execution

Overview org.webjars.npm:expr-eval is a WebJar for expr-eval Affected versions of this package are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because...