{"id":"CVE-2025-12735","aliases":["CLSA-2026-1774830287","EUVD-2025-37820","GHSA-jc85-fpwf-qm7x","ROOT-APP-NPM-CVE-2025-12735"],"status":"published","title":"CVE-2025-12735","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01761,"percentile":0.783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2025-11-05T00:22:55Z","modified":"2026-10-28T02:31:03Z","exploits":[{"source":"pocgithub","id":"alnashawatirohwederb2167-max/cve-2025-12735-expr-eval-rce","title":"alnashawatirohwederb2167-max/cve-2025-12735-expr-eval-rce","date":"2025-11-20","url":"https://github.com/alnashawatirohwederb2167-max/cve-2025-12735-expr-eval-rce"},{"source":"pocgithub","id":"AN5I/cve-2025-12735-expr-eval-rce","title":"AN5I/cve-2025-12735-expr-eval-rce","date":"2025-11-21","url":"https://github.com/AN5I/cve-2025-12735-expr-eval-rce"},{"source":"pocgithub","id":"alecasg555/safe-expr-eval","title":"alecasg555/safe-expr-eval","date":"2025-11-27","url":"https://github.com/alecasg555/safe-expr-eval"}],"fixes":[{"ecosystem":"npm","package":"expr-eval-fork","fixed_in":["3.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"expr-eval","fixed_in":["2.0.2-aikido.3","2.0.2-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/expr-eval","fixed_in":["2.0.2-root.io.1","2.0.2-root.io.2","2.0.2-root.io.3","2.0.2-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"expr-eval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"expr-eval-fork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"expr-eval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.1"}]}],"versions":["2.0.2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"expr-eval","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.0.2"}]}]},{"source":"osv","ecosystem":"npm","package":"expr-eval-fork","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"expr-eval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-aikido.3"},{"fixed":"2.0.2-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/expr-eval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-root.io.1"},{"fixed":"2.0.2-root.io.2"},{"fixed":"2.0.2-root.io.3"},{"fixed":"2.0.2-root.io.4"}]}]}],"products":[{"vendor":"expr-eval-fork","product":"expr-eval-fork"},{"vendor":"jorenbroekema","product":"javascript_expression_evaluator"},{"vendor":"silentmatt","product":"expr-eval"},{"vendor":"silentmatt","product":"javascript_expression_evaluator"}],"references":[{"url":"https://github.com/silentmatt/expr-eval","tags":["Product","package","web"]},{"url":"https://github.com/jorenbroekema/expr-eval","tags":["Product","package","web"]},{"url":"https://www.npmjs.com/package/expr-eval-fork","tags":["Product","web"]},{"url":"https://www.npmjs.com/package/expr-eval","tags":["Product","web"]},{"url":"https://github.com/silentmatt/expr-eval/pull/288","tags":["Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/advisories/GHSA-jc85-fpwf-qm7x","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://kb.cert.org/vuls/id/263614","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js","tags":["exploit","Product","evidence","web"]},{"url":"https://www.kb.cert.org/vuls/id/263614","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12735","tags":["advisory"]},{"url":"https://github.com/jorenbroekema/expr-eval/commit/1d71bb2ca8f98df8de00e9cc4de8fdd468a7ad43","tags":["web"]},{"url":"https://github.com/silentmatt/expr-eval/pull/289","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12735.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-12735","title":"CVE-2025-12735","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","status":"published","published":"2025-11-05T00:22:55.297Z","modified":"2025-11-22T23:45:45.512Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-37820","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","status":"published","published":"2025-11-05T00:22:55Z","modified":"2025-11-22T23:45:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:13.665045Z"}],"ghsa":[{"id":"GHSA-jc85-fpwf-qm7x","title":"expr-eval does not restrict functions passed to the evaluate function","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.","status":"published","published":"2025-11-05T03:30:23Z","modified":"2025-12-09T15:33:16Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-12735","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","status":"published","published":"2025-11-05T01:15:33.313Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:11:42.142547Z"}],"osv":[{"id":"CVE-2025-12735","title":"CVE-2025-12735","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","status":"published","published":"2025-11-05T00:22:55.297Z","modified":"2026-10-28T02:31:03.313725283Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"GHSA-jc85-fpwf-qm7x","title":"expr-eval does not restrict functions passed to the evaluate function","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.","status":"published","published":"2025-11-05T03:30:23Z","modified":"2026-09-10T03:50:31.031027873Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"ROOT-APP-NPM-CVE-2025-12735","title":"CVE-2025-12735 in expr-eval - Patched by Root","description":"Root has patched CVE-2025-12735 in the expr-eval package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-05T08:05:47Z","modified":"2026-10-05T09:15:06.642877868Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"CLSA-2026-1774830287","title":"TuxCare security update for expr-eval (2 CVEs)","description":"TuxCare rebuilt expr-eval to address 2 CVEs. Fixed in 2.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:34.892148533Z","updated_at":"2026-11-02T15:43:43.621843Z"}]}}