CVE-2025-12735: Code Injection
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Other sources
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12735?
The severity of CVE-2025-12735 is considered high due to the potential for remote code execution through insufficient input validation.
How do I fix CVE-2025-12735?
To fix CVE-2025-12735, update the expr-eval library to the latest version that includes input validation enhancements.
What are the potential impacts of CVE-2025-12735?
The potential impacts of CVE-2025-12735 include remote code execution and unintended manipulation of mathematical expressions.
Which versions of the expr-eval library are affected by CVE-2025-12735?
All versions of the expr-eval library prior to the fix for CVE-2025-12735 are affected.
How can I determine if my application is vulnerable to CVE-2025-12735?
You can determine if your application is vulnerable to CVE-2025-12735 by checking if it uses the affected versions of the expr-eval library without proper input validation.