CVE-2025-12735

The expr-eval and expr-eval-fork npm packages are vulnerable to critical Remote Code Execution (RCE) due to insufficient input validation in the evaluate() function. An attacker can provide a crafted context object or use the MEMBER of a context object to inject malicious code that executes at th...