CVE-2025-12735

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

The vulnerability may allow remote code execution in the context of an application using expr-eval, potentially leading to compromise of the application or server. Risk depends on whether input is user-controlled.

Update the expr-eval library to a patched version. If updating is not possible, avoid passing untrusted data to the evaluate() function and consider using an alternative library.