CVE-2026-12866: expr-eval Package Vulnerable to Code Execution
Summary
CVE-2026-12866: expr-eval vulnerable to Code Execution. Affects expr-eval versions < 2.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The expr-eval package is a JavaScript library that allows for the evaluation of mathematical expressions in a safe and controlled manner. It is widely used in applications that require dynamic expression evaluation, such as calculators and data analysis tools. However, a critical vulnerability has been identified that allows attackers to execute arbitrary JavaScript code through the toJSFunction() API, compromising the security of applications using this package.
Vulnerability Detail
The vulnerability in the expr-eval package arises from the way user-controlled expressions are transformed into executable JavaScript code. By supplying crafted expressions, an attacker can leverage the new Function() constructor to execute arbitrary code within the application's context. This can lead to severe consequences, including unauthorized access to sensitive data, manipulation of application behavior, and potential system compromise. The vulnerability affects all versions of the package up to 2.0.2, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider sanitizing user inputs to restrict the types of expressions that can be evaluated. Implementing a whitelist of allowed expressions can help mitigate the risk of arbitrary code execution.
Conclusion
The expr-eval package has a critical vulnerability that allows for code execution through user-controlled expressions. It is essential for developers using this package to update to the patched version to protect their applications from potential attacks. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.
See every vulnerability recorded for expr-eval →
FAQ
The expr-eval package is used for evaluating mathematical expressions in JavaScript applications, allowing for dynamic calculations and data analysis.
All versions of expr-eval up to and including 2.0.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected.
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
If you cannot update the package right away, consider implementing input sanitization and restricting the types of expressions that can be evaluated to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for expr-eval.
