CVE-2025-12735: expr-eval JavaScript Library RCE Flaw

CVE-2025-12735 Overview

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, CVE-2025-12735 exposes a critical code injection vulnerability due to insufficient input validation. An attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution, completely bypassing the library's intended sandboxing protections.

Critical Impact

This vulnerability allows remote attackers to achieve arbitrary code execution on systems using the affected expr-eval library through crafted context objects, potentially leading to complete system compromise.

Affected Products

• jorenbroekema javascript_expression_evaluator version 3.0.0
• silentmatt javascript_expression_evaluator (all versions prior to patch)
• expr-eval and expr-eval-fork NPM packages

Discovery Timeline

• November 5, 2025 - CVE-2025-12735 published to NVD
• February 10, 2026 - Last updated in NVD database

Technical Details for CVE-2025-12735

Vulnerability Analysis

CVE-2025-12735 is classified under CWE-94 (Improper Control of Generation of Code / Code Injection). The expr-eval library is intended to provide a safe way to evaluate mathematical and logical expressions without exposing the full power of JavaScript's eval() function. However, the vulnerability undermines this security design by allowing attackers to escape the expression sandbox.

The core issue lies in how the library handles context objects passed to the evaluate() function. When user-controlled data is passed as part of the evaluation context, the library fails to properly validate and sanitize these inputs. This allows an attacker to craft malicious context objects that, when accessed during expression evaluation, can execute arbitrary JavaScript code outside the intended sandbox.

This vulnerability is particularly dangerous in applications that accept user input for mathematical expression evaluation, such as calculators, spreadsheet applications, data transformation tools, or any system that allows users to define custom formulas.

Root Cause

The root cause stems from insufficient input validation when processing context objects in the evaluate() function. The library trusts that context object properties are safe values (numbers, strings, or simple functions), but fails to account for malicious object members that can leverage JavaScript's dynamic nature to break out of the evaluation sandbox. Property accessors, prototype manipulation, or specially crafted function references within the context can be exploited to achieve code execution.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a crafted HTTP request or API call to an application that uses expr-eval to process user-provided expressions or context data.

The exploitation flow involves:

1. Identifying an application endpoint that uses expr-eval for expression evaluation
2. Crafting a malicious context object containing properties designed to escape the sandbox
3. Submitting the malicious context along with an expression that accesses the crafted properties
4. The evaluate() function processes the expression, triggering arbitrary code execution

For detailed technical exploitation information, refer to the GitHub Security Advisory and CERT Vulnerability ID 263614.

Detection Methods for CVE-2025-12735

Indicators of Compromise

• Unexpected child processes spawned by Node.js applications using expr-eval
• Anomalous network connections originating from Node.js runtime processes
• Unusual file system access patterns from applications that should only perform mathematical calculations
• Error logs showing unexpected property access or function invocations during expression evaluation

Detection Strategies

• Monitor application logs for unusual expressions containing object member access patterns or prototype references
• Implement runtime application self-protection (RASP) to detect sandbox escape attempts
• Use dependency scanning tools to identify vulnerable versions of expr-eval in your projects
• Deploy web application firewalls (WAF) with rules to detect suspicious expression payloads

Monitoring Recommendations

• Enable verbose logging for all expr-eval evaluate() function calls, capturing both expressions and context objects
• Implement anomaly detection for expression complexity and context object structure
• Monitor for npm audit alerts related to expr-eval packages in CI/CD pipelines
• Track process behavior for Node.js applications to detect signs of code injection exploitation

How to Mitigate CVE-2025-12735

Immediate Actions Required

• Audit your codebase for usage of expr-eval or expr-eval-fork NPM packages
• Review all locations where user input is passed to the evaluate() function, either as expressions or context objects
• Apply the security patch referenced in GitHub Pull Request #288
• Consider switching to alternative expression evaluation libraries with stronger sandboxing until patches are fully deployed

Patch Information

Security fixes are being tracked in Pull Request #288 for the silentmatt/expr-eval repository. Organizations should monitor both the silentmatt expr-eval repository and the jorenbroekema expr-eval fork for updated releases containing the security fixes. Review the NPM package page for expr-eval for the latest patched versions.

Workarounds

• Implement strict input validation on all context objects before passing them to evaluate(), allowing only primitive types (numbers, strings, booleans)
• Disable or restrict the ability for users to provide custom context objects entirely
• Run expr-eval in an isolated environment (such as a separate VM or container) to limit the impact of potential exploitation
• Implement a whitelist of allowed expression patterns and reject any expressions that don't match

# Example: Check for vulnerable expr-eval versions in your project
npm audit | grep -i "expr-eval"

# List all installed expr-eval versions
npm ls expr-eval expr-eval-fork

# Update to patched version when available
npm update expr-eval