10minions-engine (>=0.0.1, <=0.0.4), 3ui (>=0.1.0, <=0.1.8) +2037 more potentially affected by CVE-2025-13204 via expr-eval (>=0.12.0, <=2.0.2)

expr-eval NPM version =0.12.0, =0.0.1, =0.1.0, =1.0.2, =1.2.0, =1.0.0, =0.1.4, =0.0.1, =0.4.2, =0.4.4 - @activepieces/piece-aianswer 0.1.5 and more Source cves: CVE-2025-13204 Source advisory: SNYK:JS-EXPREVAL-13508636...

Prototype Pollution in silentmatt/expr-eval

✍️ Description With speficific input attckers can define properties on prototype, which will lead to prototype pollution. Need node version=12.0.0, which introduce Object.fromEntries 🕵️‍♂️ Proof of Concept // PoC.js const Parser = require'expr-eval'; const o = ; console.log"o.a=", o.a; // o.a=...