CVE-2025-13204 CVE-2025-13204
An attacker can achieve arbitrary code execution via prototype pollution in the expr-eval npm package by exploiting its expression evaluation interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13204?
CVE-2025-13204 is a high-severity code injection vulnerability in silentmatt expr-eval, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
Weakness: CWE-1321
Which versions are affected by CVE-2025-13204?
4 open source packages ship an affected version, including expr-eval and expr-eval-fork. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
expr-eval npm | All versions to 2.0.2 | None |
expr-eval npm | All versions to 2.0.2 | None |
expr-eval-fork npm | All versions | 2.0.2 |
expr-eval-fork npm | All versions | 2.0.2 |
Linux distribution packages (1)
grafana-pcp Red Hat:rhel_aus:8.2::appstream | All versions | 0:1.0.5-5.el8_2 |
Products include Silentmatt Javascript Expression Evaluator.
How do I fix CVE-2025-13204?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-13204 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13204 exists.
Sources
Also known as GHSA-8gw3-rxh4-v6jx, MINI-42xw-4wg6-3q3v, MINI-5f6w-5293-fgvx, MINI-8jjw-jg2f-g5pv, MINI-f2gw-7pc8-q7c3, MINI-fcqj-9c49-p8gr and 5 more.