{"id":"CVE-2025-12735","revision":"63d8d348b6994474885daaf9ad478af6","records":[{"revision":"63d8d348b6994474885daaf9ad478af6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-12735","aliases":[],"title":"CVE-2025-12735","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","state":0,"publishedAt":"2025-11-05T00:22:55.297+00:00","modifiedAt":"2025-11-22T23:45:45.512+00:00","affected":[{"ecosystem":"Vendor product","name":"expr-eval","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"silentmatt\",\n                    \"product\": \"expr-eval\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"2.0.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"expr-eval-fork","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"expr-eval-fork\",\n                    \"product\": \"expr-eval-fork\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"3.0.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/silentmatt/expr-eval","https://github.com/jorenbroekema/expr-eval","https://www.npmjs.com/package/expr-eval-fork","https://www.npmjs.com/package/expr-eval","https://github.com/silentmatt/expr-eval/pull/288","https://github.com/advisories/GHSA-jc85-fpwf-qm7x","https://kb.cert.org/vuls/id/263614"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-12735","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-12735","identifiers":["CVE-2025-12735"]},"retained":false,"historicalAffected":[]}],"coverage":[]}