{"id":"CVE-2025-13204","aliases":[],"cve":{"records":[{"id":"CVE-2025-13204","source":"certcc","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-11-14T16:52:35.957Z","published":"2025-11-14T17:02:39.529Z","modified":"2026-10-30T18:06:36.383Z"}],"publishers":[{"name":"certcc","role":"CNA","organizationId":"37e5125f-f79b-445b-8fad-9564f167944b","modified":"2025-11-14T20:20:20.104Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T18:06:36.383Z"}],"references":[{"url":"https://www.npmjs.com/package/expr-eval-fork","tags":[],"source":"certcc"},{"url":"https://github.com/silentmatt/expr-eval","tags":[],"source":"certcc"},{"url":"https://github.com/jorenbroekema/expr-eval","tags":[],"source":"certcc"},{"url":"https://www.huntr.dev/bounties/1-npm-expr-eval/","tags":["third-party-advisory"],"source":"certcc"},{"url":"https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py","tags":[],"source":"certcc"},{"url":"https://github.com/silentmatt/expr-eval/pull/252/files","tags":["patch"],"source":"certcc"},{"url":"https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py","tags":["exploit"],"source":"certcc"}],"weaknesses":[{"id":"CWE-1321","description":"CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T18:06:32.275092Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"npm package expr-eval is vulnerable to Prototype Pollution.","titleSource":"certcc","descriptionSource":"certcc","description":"npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.","score":9.8,"severity":"critical","published":"2025-11-14T17:02:39.529Z","modified":"2026-10-30T18:06:36.383Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"silentmatt","name":"expr-eval","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.2","versionType":"custom"}],"cpes":[],"source":"certcc","url":"https://www.cve.org/CVERecord?id=CVE-2025-13204"}],"remediation":[],"references":["https://www.npmjs.com/package/expr-eval-fork","https://github.com/silentmatt/expr-eval","https://github.com/jorenbroekema/expr-eval","https://www.huntr.dev/bounties/1-npm-expr-eval/","https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py","https://github.com/silentmatt/expr-eval/pull/252/files","https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py"],"sources":[{"name":"CVE","id":"CVE-2025-13204","modified":"2026-10-30T18:06:36.383Z","url":"https://www.cve.org/CVERecord?id=CVE-2025-13204"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-10-30T19:12:16.137Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T05:35:31.277Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}