CVE-2025-13204: expr-eval JavaScript RCE Vulnerability

CVE-2025-13204 Overview

The npm package expr-eval is vulnerable to Prototype Pollution, a critical class of vulnerability affecting JavaScript applications. An attacker with access to the expression evaluation interface can exploit JavaScript's prototype-based inheritance model to achieve arbitrary code execution. This vulnerability affects the Silentmatt JavaScript Expression Evaluator library, commonly used for parsing and evaluating mathematical expressions in Node.js applications.

Critical Impact

Attackers can exploit prototype pollution to modify object prototypes, potentially leading to arbitrary code execution, denial of service, or security control bypass in applications using the vulnerable expr-eval package.

Affected Products

• silentmatt javascript_expression_evaluator (Node.js package)
• Applications using the expr-eval npm package
• Web applications and backend services implementing expression evaluation using this library

Discovery Timeline

• 2025-11-14 - CVE-2025-13204 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-13204

Vulnerability Analysis

This vulnerability (CWE-1321: Improper Neutralization of Special Elements in Data Query Logic) exists due to insufficient input validation in the expr-eval library's expression parsing functionality. Prototype Pollution occurs when an attacker can inject properties into JavaScript's base Object.prototype, which then propagates to all objects in the application. In the context of expr-eval, this allows attackers to manipulate the expression evaluator to execute arbitrary code by polluting object prototypes during expression parsing.

The vulnerability is exploitable via network-accessible interfaces where the library processes user-controlled input. No authentication is required to exploit this vulnerability, and it can affect the confidentiality, integrity, and availability of affected systems.

Root Cause

The root cause lies in the expr-eval library's failure to properly sanitize user-supplied expressions before evaluation. When parsing expressions, the library does not adequately prevent access to or modification of __proto__, constructor, or prototype properties. This allows malicious expressions to traverse the prototype chain and modify base object prototypes, affecting all JavaScript objects in the application context.

Attack Vector

The attack vector is network-based, requiring no user interaction or special privileges. An attacker can craft malicious expressions containing prototype-polluting payloads and submit them to any application endpoint that uses expr-eval to process user input. The exploitation path typically involves:

1. Identifying an application using expr-eval for expression evaluation
2. Crafting a malicious expression that accesses prototype properties
3. Submitting the payload through the expression evaluation interface
4. The polluted prototype affecting subsequent application behavior, potentially enabling code execution

The vulnerability has been demonstrated in CTF competitions, with a solver script available on GitHub showing exploitation techniques. Technical details can also be found in the Huntr.dev bug bounty report.

Detection Methods for CVE-2025-13204

Indicators of Compromise

• Unusual expressions containing __proto__, constructor.prototype, or prototype strings in application logs
• Unexpected modifications to global object properties in Node.js applications
• Application behavior changes indicating prototype chain manipulation
• Error messages related to unexpected property access or type confusion

Detection Strategies

• Implement input validation logging to capture expressions containing prototype-related keywords such as __proto__, constructor, and prototype
• Deploy application-level monitoring to detect anomalous expression patterns submitted to evaluation endpoints
• Use Software Composition Analysis (SCA) tools to identify applications with vulnerable expr-eval versions in the dependency tree
• Monitor for runtime modifications to Object.prototype or other base prototypes in Node.js applications

Monitoring Recommendations

• Enable verbose logging for all expression evaluation operations to capture potential exploitation attempts
• Implement rate limiting on expression evaluation endpoints to slow down brute-force prototype pollution attempts
• Set up alerts for dependency vulnerabilities in CI/CD pipelines to catch vulnerable expr-eval installations
• Monitor application memory and behavior for signs of prototype pollution exploitation

How to Mitigate CVE-2025-13204

Immediate Actions Required

• Audit your application dependencies for the presence of the expr-eval npm package using npm audit or yarn audit
• Replace the vulnerable expr-eval package with the patched fork expr-eval-fork
• If immediate replacement is not possible, implement input validation to reject expressions containing __proto__, constructor, or prototype strings
• Review application logs for any evidence of exploitation attempts

Patch Information

The original expr-eval package maintainers have addressed this issue through a pull request on GitHub. Users should either update to a patched version once merged or migrate to the expr-eval-fork package which resolves this vulnerability. The fork is available on npm and can be installed as a drop-in replacement for the vulnerable package.

Workarounds

• Implement a wrapper function that sanitizes expressions before passing them to expr-eval, blocking any input containing prototype-related keywords
• Use Object.freeze(Object.prototype) as a defense-in-depth measure to prevent prototype modifications at runtime
• Isolate expression evaluation in a sandboxed environment or separate process with limited privileges
• Consider implementing a whitelist-based approach for allowed expression syntax rather than blacklisting dangerous patterns

# Replace vulnerable package with patched fork
npm uninstall expr-eval
npm install expr-eval-fork

# Audit your dependencies for vulnerabilities
npm audit

# Verify the replacement
npm list expr-eval expr-eval-fork