Critical 9.8Published Nov 4, 2025

CVE-2025-12735CVE-2025-12735

Updated under an hour ago (Oct 27, 2026, 3:00 PM ET)

Does this affect you?

It affects silentmatt expr-eval and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for silentmatt expr-eval

Exploited in the last 30 days

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94, CWE-1321
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: certcc
NVD analysis: Analyzed
Record last updated: Nov 22, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

silentmatt expr-eval silentmatt:expr_eval (from the name)	through 2.0.2	CNA record
expr-eval-fork expr-eval-fork expr_eval_fork:expr_eval_fork (from the name)	through 3.0.0	CNA record
jorenbroekema javascript_expression_evaluator jorenbroekema:javascript_expression_evaluator	3.0.0	NVD
silentmatt javascript_expression_evaluator silentmatt:javascript_expression_evaluator	through 2.0.2	NVD

References

References

https://github.com/silentmatt/expr-eval	product
https://github.com/jorenbroekema/expr-eval	product
https://www.npmjs.com/package/expr-eval-fork	product
https://www.npmjs.com/package/expr-eval	product
https://github.com/silentmatt/expr-eval/pull/288	issue-tracking, patch
https://github.com/advisories/GHSA-jc85-fpwf-qm7x	third-party-advisory
https://kb.cert.org/vuls/id/263614	third-party-advisory
https://www.kb.cert.org/vuls/id/263614	third-party-advisory
https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.