npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
References
| Link | Resource |
|---|---|
| https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py | Product |
| https://github.com/jorenbroekema/expr-eval | Product |
| https://github.com/silentmatt/expr-eval | Product |
| https://github.com/silentmatt/expr-eval/pull/252/files | Patch Issue Tracking |
| https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py | Product |
| https://www.huntr.dev/bounties/1-npm-expr-eval/ | Exploit Third Party Advisory |
| https://www.npmjs.com/package/expr-eval-fork | Product |
Configurations
History
No history.
Information
Published : 2025-11-14 17:16
Updated : 2026-01-08 18:28
NVD link : CVE-2025-13204
Mitre link : CVE-2025-13204
CVE.ORG link : CVE-2025-13204
JSON object : View
Products Affected
silentmatt
- javascript_expression_evaluator
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')