CVE-2025-12735 CVE-2025-12735
Attackers can achieve arbitrary code execution in the expr-eval JavaScript library by passing crafted context objects to the evaluate function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12735?
CVE-2025-12735 is a critical code injection vulnerability in expr-eval-fork expr-eval, published on 5 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Weakness: CWE-94
Which versions are affected by CVE-2025-12735?
4 open source packages ship an affected version, including expr-eval-fork and expr-eval. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
expr-eval-fork npm | All versions | 3.0.1 |
expr-eval-fork npm | All versions | 3.0.1 |
expr-eval npm | All versions to 2.0.2 | None |
expr-eval npm | All versions to 2.0.2 | None |
Products include Jorenbroekema Javascript Expression Evaluator, Silentmatt Javascript Expression Evaluator.
How do I fix CVE-2025-12735?
Upgrade expr-eval-fork to 3.0.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-12735 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12735 exists.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-jc85-fpwf-qm7x, MINI-5f9w-64w5-fj29, MINI-5q92-fx8f-48h8, MINI-67pm-4g9j-7gqw, MINI-6fq3-38wm-xpgq, MINI-6p87-g8qj-h3gp and 4 more.