Description

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

INFO

Published Date :

2025-11-05T00:22:55.297Z

Last Modified :

2025-11-22T23:45:45.512Z

Source :

certcc
AFFECTED PRODUCTS

The following products are affected by CVE-2025-12735 vulnerability.

Vendors Products
Expr-eval Project
  • Expr-eval
Jorenbroekema
  • Javascript Expression Evaluator
Silentmatt
  • Javascript Expression Evaluator
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-12735.

URL Resource
https://github.com/advisories/GHSA-jc85-fpwf-qm7x cve-icon cve-icon
https://github.com/jorenbroekema/expr-eval cve-icon cve-icon cve-icon
https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js cve-icon cve-icon
https://github.com/silentmatt/expr-eval cve-icon cve-icon cve-icon
https://github.com/silentmatt/expr-eval/pull/288 cve-icon cve-icon cve-icon
https://kb.cert.org/vuls/id/263614 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-12735 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-12735 cve-icon
https://www.kb.cert.org/vuls/id/263614 cve-icon
https://www.npmjs.com/package/expr-eval cve-icon cve-icon cve-icon
https://www.npmjs.com/package/expr-eval-fork cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact