{"id":"EUVD-2025-37820","enisaUuid":"0538e14d-65a0-31a5-ac62-adc2f1b3559b","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","datePublished":"Nov 5, 2025, 12:22:55 AM","dateUpdated":"Nov 22, 2025, 11:45:45 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/silentmatt/expr-eval\nhttps://github.com/jorenbroekema/expr-eval\nhttps://www.npmjs.com/package/expr-eval-fork\nhttps://www.npmjs.com/package/expr-eval\nhttps://github.com/silentmatt/expr-eval/pull/288\nhttps://github.com/advisories/GHSA-jc85-fpwf-qm7x\nhttps://kb.cert.org/vuls/id/263614\n","aliases":"CVE-2025-12735\nGHSA-jc85-fpwf-qm7x\n","assigner":"certcc","epss":1.76,"enisaIdProduct":[{"id":"041cb29b-1693-32e5-9a0b-71f2e9fcfb41","product":{"name":"expr-eval-fork","vendor":{"name":"expr-eval-fork"}},"product_version":"0 ≤3.0.0"},{"id":"e2dff7d0-5c0b-35aa-93e2-7656c7ffc2b1","product":{"name":"expr-eval","vendor":{"name":"silentmatt"}},"product_version":"0 ≤2.0.2"}],"enisaIdVendor":[{"id":"b6be3b78-788f-3289-b5a1-248bebc3c0fb","vendor":{"name":"expr-eval-fork"}},{"id":"e3534f34-c702-387d-9c08-6377309c4a4e","vendor":{"name":"silentmatt"}}],"enisaIdVulnerability":[{"id":"51d7d8bf-2dfc-31ae-b0e6-c2be71d227cc","vulnerability":{"id":"GHSA-jc85-fpwf-qm7x","description":"expr-eval does not restrict functions passed to the evaluate function","datePublished":"Nov 5, 2025, 3:30:23 AM","dateUpdated":"Dec 9, 2025, 3:33:15 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-12735\nhttps://github.com/silentmatt/expr-eval/pull/288\nhttps://github.com/silentmatt/expr-eval/pull/289\nhttps://github.com/jorenbroekema/expr-eval/commit/1d71bb2ca8f98df8de00e9cc4de8fdd468a7ad43\nhttps://github.com/jorenbroekema/expr-eval\nhttps://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js\nhttps://github.com/silentmatt/expr-eval\nhttps://kb.cert.org/vuls/id/263614\nhttps://www.kb.cert.org/vuls/id/263614\nhttps://www.npmjs.com/package/expr-eval\nhttps://www.npmjs.com/package/expr-eval-fork\n","enisa_id":"EUVD-2025-37820\n","aliases":"GHSA-jc85-fpwf-qm7x\nCVE-2025-12735\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b59a6a45-15be-3b2e-83b5-08c9911cf3bf","vulnerability":{"id":"CVE-2025-12735","description":"The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.","datePublished":"Nov 5, 2025, 12:22:55 AM","dateUpdated":"Nov 22, 2025, 11:45:45 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/silentmatt/expr-eval\nhttps://github.com/jorenbroekema/expr-eval\nhttps://www.npmjs.com/package/expr-eval-fork\nhttps://www.npmjs.com/package/expr-eval\nhttps://github.com/silentmatt/expr-eval/pull/288\nhttps://github.com/advisories/GHSA-jc85-fpwf-qm7x\nhttps://kb.cert.org/vuls/id/263614\n","enisa_id":"EUVD-2025-37820\n","assigner":"certcc","epss":1.76,"dataProcessed":"Nov 6, 2026, 7:18:07 AM","vulnerabilityProduct":[{"id":"044a7f55-49fe-34f1-ad3f-8cc4d80c7452","product":{"name":"expr-eval-fork","vendor":{"name":"expr-eval-fork"}},"product_version":"0 ≤3.0.0"},{"id":"966df435-677a-31ec-94fd-839661500a96","product":{"name":"expr-eval","vendor":{"name":"silentmatt"}},"product_version":"0 ≤2.0.2"}],"vulnerabilityVendor":[{"id":"059b1b36-b411-3b65-bfbf-0cbcf40a80af","vendor":{"name":"expr-eval-fork"}},{"id":"e1f83caf-1ff1-30f2-9608-f011071bb405","vendor":{"name":"silentmatt"}}]}}],"enisaIdAdvisory":[]}