npm package expr-eval is vulnerable to Prototype Pollution.
Impact
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
Source excerpt · certccAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
silentmatt · certcc
expr-eval
1 range
silentmatt · certcc
expr-eval
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → through 2.0.2
custom versions
Other versions: unknown
Original source description
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2025-13204View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CISA-ADP
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.