Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2025-13204

CVE-2025-13204

npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Expr-eval Project Silentmatt
Products
Expr-eval Javascript Expression Evaluator
CVE-2025-12735

CVE-2025-12735

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Expr-eval Project Jorenbroekema Silentmatt
Products
Expr-eval Javascript Expression Evaluator Javascript Expression Evaluator