Skip to main content

CISA updates on a vulnerability in expr-eval JavaScript library enabling code execution

Source Decision Insights Threat Desk Published November 28, 2025 Companies 2
Human View Machine View

2 companies named across 7 categories, one of 40 articles referencing GitHub. Previous coverage: CISA issues alert on NPM supply chain compromise involving credential theft and malware (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Practitioner
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

The expr-eval JavaScript package, utilized for processing mathematical expressions in various applications including Natural Language Processing (NLP) and Artificial Intelligence (AI), contains a vulnerability that could permit an attacker to execute arbitrary code on affected systems.

The vulnerability, tracked as CVE-2025-12735, affects versions of the expr-eval and expr-eval-fork libraries which parse and evaluate mathematical expressions via the Parser class and its evaluate() method. These libraries serve to safely evaluate user-defined expressions, offering an alternative to JavaScript's native eval() function, especially in server-side environments to limit access to local resources. The vulnerability enables an attacker to supply maliciously crafted input that can define arbitrary functions in the parser's context object, potentially triggering system-level command execution. Additionally, CVE-2025-13204 references an earlier Prototype Pollution issue in expr-eval, unresolved in the original but addressed in expr-eval-fork as of the 2024-01-10 release. The fix for CVE-2025-12735 was merged via Pull Request #288. Both CVEs are cataloged in GitHub Advisory GHSA-jc85-fpwf-qm7x and are detectable through automated tools like Network Performance Monitor (NPM) audit.

Exploitation of this vulnerability allows an attacker with control over input fields processed by expr-eval to execute commands arbitrarily on the host system. This results in a total technical impact as defined by the SSVC framework, granting the attacker full control of software behavior or complete disclosure of system information.

To address this issue, developers and users are recommended to apply the security patch from Pull Request #288 or update to the latest secure versions of expr-eval or expr-eval-fork once available. The patch introduces an AllowList specifying safe functions accessible via evaluate(), a compulsory registration process for custom functions, and enhanced test cases enforcing these measures.

The vulnerability was disclosed by reporter Jangwoo Choe (UKO), with patch improvements contributed by user huydoppaze. Recognition is also extended to GitHub Security and NPM for their roles in issuing security advisories and enabling automated vulnerability detection. The advisory content was authored by Vijay Sarvepalli and Renae Metcalf.

Blog post, originally published by Vijay Sarvepalli and Renae Metcalf at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-updates-on-a-vulnerability-in-expr-eval-javascript-library-enabling-code-execution/",
        "name": "CISA updates on a vulnerability in expr-eval JavaScript library enabling code execution",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-updates-on-a-vulnerability-in-expr-eval-javascript-library-enabling-code-execution/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
      "name": "GitHub"
    },
    "articleSection": [
      "Cybersecurity",
      "Artificial Intelligence",
      "AI infrastructure"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:04:05-06:00",
    "datePublished": "2025-11-28T21:59:27-07:00",
    "description": "CISA reports a vulnerability in expr-eval JavaScript library allowing arbitrary code execution through malicious input.",
    "headline": "CISA updates on a vulnerability in expr-eval JavaScript library enabling code execution",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Vijay Sarvepalli and Renae Metcalf"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/263614"
    },
    "keywords": [
      "Natural Language Processing",
      "Network Performance Monitor",
      "Patch",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-updates-on-a-vulnerability-in-expr-eval-javascript-library-enabling-code-execution/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
        "name": "GitHub"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages