CVE-2025-12735

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluat...

CVE-2025-12735

The expr-eval and expr-eval-fork npm packages are vulnerable to critical Remote Code Execution (RCE) due to insufficient input validation in the evaluate() function. An attacker can provide a crafted context object or use the MEMBER of a context object to inject malicious code that executes at th...

PT-2025-45736

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate function and trigger arbitrary...