All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Becaus…

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-12866 · CVE overview and exploitation status

EUVD-2026-38415

GHSA-q9v2-7m5w-4693

cve-program · CVE-2026-12866

• https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17662018
• https://github.com/silentmatt/expr-eval/blob/master/src/expression.js%23L55
• https://github.com/silentmatt/expr-eval/issues/292

euvd · EUVD-2026-38415

• https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17662018
• https://github.com/silentmatt/expr-eval/blob/master/src/expression.js%23L55
• https://github.com/silentmatt/expr-eval/issues/292

nvd · CVE-2026-12866

• https://github.com/silentmatt/expr-eval/blob/master/src/expression.js%23L55
• https://github.com/silentmatt/expr-eval/issues/292
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17662018
• https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690

osv · GHSA-q9v2-7m5w-4693

• https://nvd.nist.gov/vuln/detail/CVE-2026-12866
• https://github.com/silentmatt/expr-eval/issues/292
• https://github.com/silentmatt/expr-eval
• https://github.com/silentmatt/expr-eval/blob/master/src/expression.js#L55
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17662018
• https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690

No related changes are available here.