CVE-2026-12866 expr-eval vulnerable to Code Execution
Attackers can execute arbitrary JavaScript code by supplying crafted expressions to the toJSFunction API, bypassing the intended sandbox.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12866?
CVE-2026-12866 is a critical code injection vulnerability in expr-eval, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.
Weakness: CWE-94
Which versions are affected by CVE-2026-12866?
4 open source packages ship an affected version, including org.webjars.npm:expr-eval and expr-eval.
| Package | Affected | Fixed in |
|---|---|---|
org.webjars.npm:expr-eval Maven | All versions to 2.0.2 | None |
org.webjars.npm:expr-eval Maven | All versions to 2.0.2 | None |
expr-eval npm | All versions to 2.0.2 | None |
expr-eval npm | All versions to 2.0.2 | None |
How do I fix CVE-2026-12866?
No fix published yet.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-12866 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12866 exists.
Sources
Also known as CLSA-2026-1792241023, GHSA-q9v2-7m5w-4693, MINI-82jp-6mpf-372q, MINI-8j87-6r7x-pw3p, MINI-crgw-qrc7-vgc9, MINI-gj57-qfx6-6ff6 and 4 more.