Skip to main content

CISA issues alert on expr-eval vulnerability enabling arbitrary code execution

Source Decision Insights Threat Desk Published November 21, 2025 Companies 2
Human View Machine View

2 companies named across 8 categories, one of 36 articles referencing GitHub. Previous coverage: Over 500 NPM Packages Compromised in Supply Chain Attack via Socket (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

The expr-eval JavaScript library, used for evaluating mathematical expressions in various software including Natural Language Processing (NLP) and Artificial Intelligence (AI) applications, contains a vulnerability that enables arbitrary code execution.

The projects expr-eval and its fork expr-eval-fork, which parse and evaluate mathematical expressions, rely on the Parser class and its evaluate() method to safely interpret user-defined inputs compared to JavaScript's native eval() function. Expr-eval has over 250 dependent packages, including oplangchain. The expr-eval-fork was created to address a Prototype Pollution issue (Issue #266) unresolved in the original expr-eval repository, which has not been updated since September 28, 2019. The recently discovered vulnerability (CVE-2025-12735) allows attackers to define arbitrary functions within the parser's context object, facilitating malicious code injection capable of executing system-level commands. This vulnerability, tracked by GitHub Advisory GHSA-jc85-fpwf-qm7x, has been addressed by Pull Request #288. Additionally, CVE-2025-13204 relates to the earlier Prototype Pollution vulnerability, which remains unpatched in expr-eval but was addressed in the expr-eval-fork release dated January 10, 2024.

This vulnerability permits attackers who can influence inputs processed by expr-eval to execute arbitrary commands on the host system, granting total control over software behavior or full disclosure of all information on the affected system, constituting a Technical Impact classified as Total under the SSVC framework.

The resolution involves applying the patch introduced by Pull Request #288 or upgrading to the latest patched versions of expr-eval or expr-eval-fork when available. The patch implements a defined AllowList of functions accessible via evaluate(), enforces mandatory registration for custom functions, and includes updated test cases to ensure these constraints are enforced.

Recognition is given to Jangwoo Choe for responsibly reporting the vulnerability, to huydoppaze for contributions enhancing the patch, and to GitHub Security and Network Performance Monitor (NPM) for their roles in issuing security advisories and performing automated vulnerability audits. This advisory was authored by Vijay Sarvepalli and Renae Metcalf.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-expr-eval-vulnerability-enabling-arbitrary-code-execution/",
        "name": "CISA issues alert on expr-eval vulnerability enabling arbitrary code execution",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-expr-eval-vulnerability-enabling-arbitrary-code-execution/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
      "name": "GitHub"
    },
    "articleSection": [
      "Artificial Intelligence",
      "Cybersecurity",
      "AI infrastructure"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:03:25-06:00",
    "datePublished": "2025-11-21T17:59:42-07:00",
    "description": "CISA reports a vulnerability in expr-eval JavaScript library enabling arbitrary code execution through crafted input manipulation.",
    "headline": "CISA issues alert on expr-eval vulnerability enabling arbitrary code execution",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/263614"
    },
    "keywords": [
      "Natural Language Processing",
      "Network Performance Monitor",
      "Patch",
      "Software",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-expr-eval-vulnerability-enabling-arbitrary-code-execution/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
        "name": "GitHub"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages