Critical RCE Vulnerability (CVE-2025-12735) in JavaScript Library expr-eval and expr-eval-fork – Risk and Remediation Guide

Executive Summary

A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-12735, has been identified in the popular JavaScript library expr-eval and its actively maintained fork, expr-eval-fork. This vulnerability enables attackers to execute arbitrary code on affected systems by supplying malicious input to the library’s evaluate() function. The flaw is rated as critical with a CVSS score of 9.8, reflecting its ease of exploitation and the potential for complete system compromise. Both the original expr-eval package and all pre-3.0.0 versions of expr-eval-fork are impacted. The vulnerability is being widely discussed in the cybersecurity community, and proof-of-concept (PoC) code is publicly available, significantly increasing the risk of exploitation. Organizations using these libraries in web applications, AI/NLP platforms, financial tools, or any system that parses user-supplied mathematical expressions are at immediate risk and should take urgent action to mitigate exposure.

Technical Information

The CVE-2025-12735 vulnerability stems from insufficient validation of the variables or context object passed to the expr-evalParser.evaluate() function. In both the original expr-eval and its fork, the parser allows user-supplied objects to be injected as variables. If an attacker supplies a function object as a variable, the parser will invoke it during expression evaluation, enabling arbitrary code execution within the application’s runtime context.

This vulnerability is particularly dangerous because it can be triggered remotely, without authentication, simply by submitting crafted input to any application endpoint that uses expr-eval to parse or evaluate user-supplied expressions. The attack surface is broad, as expr-eval is widely used in online calculators, educational tools, financial applications, and AI/NLP systems that process mathematical expressions.

The technical root cause is the lack of a strict allowlist or registration mechanism for functions that can be invoked by the parser. In vulnerable versions, any function present in the context object is callable, and the parser does not restrict or sanitize these calls. This design flaw allows attackers to inject malicious functions, such as those invoking Node.js’s child_process.exec, leading to full remote code execution.

A typical exploitation scenario involves an attacker submitting an expression like malicious(), with the context object containing a function definition for malicious that executes arbitrary system commands. For example, the following code, adapted from the public PoC, demonstrates the attack:

javascript const Parser = require('expr-eval').Parser; const parser = new Parser(); const context = { malicious: () => { require('child_process').exec('touch /tmp/pwned'); } }; parser.evaluate('malicious()', context);

When this code is executed, it creates a file /tmp/pwned on the server, proving that arbitrary commands can be run. The impact is total compromise of confidentiality, integrity, and availability, as attackers can exfiltrate data, modify files, or disrupt services.

The vulnerability was discovered by Jangwoo Choe and publicly disclosed on November 4, 2025. It affects all versions of the original expr-eval (which is now unmaintained) and all versions of expr-eval-fork prior to 3.0.0. The maintainers of expr-eval-fork have released version 3.0.0, which introduces a secure function registration system and an allowlist, effectively mitigating the flaw. The original expr-eval has not been patched, and migration to the fork is strongly recommended.

The vulnerability is cataloged in the National Vulnerability Database (NVD), CERT/CC, and is the subject of advisories from Snyk and other security vendors. The public PoC and active discussion on social media and security forums underscore the urgency of remediation.

Exploitation in the Wild

As of the time of this report, there are no confirmed incidents of exploitation in the wild. However, the vulnerability is trivial to exploit, and the availability of public PoC code significantly lowers the barrier for attackers. Security researchers and practitioners have demonstrated the exploit on GitHub and discussed it on platforms such as X (formerly Twitter) and LinkedIn. The vulnerability is being actively monitored by the security community, and its critical nature suggests that opportunistic and targeted attacks are likely to emerge rapidly.

Indicators of compromise (IOCs) include unexpected execution of system commands from applications using expr-eval, the presence of unusual function objects or code in the variables parameter of evaluate(), and evidence of outbound connections or data exfiltration from affected servers. Organizations should monitor application logs for anomalous activity related to expression evaluation and review any use of expr-eval in their codebase.

APT Groups using this vulnerability

There is currently no public attribution of this vulnerability to specific advanced persistent threat (APT) groups. However, the characteristics of CVE-2025-12735 make it highly attractive to a broad spectrum of threat actors, including APTs, cybercriminals, and supply chain attackers. The vulnerability aligns with MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter) and T1203 (Exploitation for Client Execution), both of which are commonly leveraged by sophisticated adversaries. Given the widespread use of expr-eval in AI/NLP platforms, financial technology stacks, and web applications, it is plausible that APT groups will incorporate this exploit into their toolkits for initial access, lateral movement, or data exfiltration in the near future.

Affected Product Versions

The following product versions are confirmed to be affected by CVE-2025-12735:

The original expr-eval package is vulnerable in all versions from 0.0.0 up to and including 2.0.2. No fixed version is available, and the project is considered unmaintained.

The expr-eval-fork package is vulnerable in all versions from 0.0.0 up to and including 2.0.2. The vulnerability is patched in version 3.0.0 and later.

Organizations using any of these versions in production, development, or as a transitive dependency in other packages are at risk. The vulnerability affects both direct and indirect consumers of the library, including over 250 dependent projects and applications with more than 800,000 weekly downloads from NPM.

Workaround and Mitigation

Immediate mitigation is essential to prevent exploitation. The recommended course of action is to migrate all usage of the original expr-eval and vulnerable versions of expr-eval-fork to expr-eval-fork version 3.0.0 or later. The patched fork introduces a secure function registration system and an allowlist, ensuring that only explicitly registered functions can be invoked during expression evaluation.

For organizations unable to migrate immediately, it is critical to audit all code paths where user-supplied input is passed to expr-eval. Input validation and sanitization should be enforced, and the use of untrusted context objects should be strictly prohibited. However, these measures are not foolproof, and migration to the patched fork remains the only reliable remediation.

The original expr-eval has a proposed fix in a pull request, but it has not been merged, and the project is effectively unmaintained. Continued use of the original package is strongly discouraged.

Vendor advisories and additional guidance are available from the expr-eval-fork NPM page and CERT/CC. Organizations should also review their software supply chain for transitive dependencies on expr-eval and coordinate with third-party vendors as necessary.

References

BleepingComputer: Popular JavaScript library expr-eval vulnerable to RCE flaw https://www.bleepingcomputer.com/news/security/popular-javascript-library-expr-eval-vulnerable-to-rce-flaw/

NVD: CVE-2025-12735 https://nvd.nist.gov/vuln/detail/CVE-2025-12735

CERT/CC VU#263614 https://kb.cert.org/vuls/id/263614

GitHub PoC https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js

Snyk Security Advisory https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-13833679

Feedly CVE-2025-12735 https://feedly.com/cve/CVE-2025-12735

Vulert CVE-2025-12735 https://vulert.com/vuln-db/CVE-2025-12735

LinkedIn Security Post https://www.linkedin.com/posts/the-cyber-security-hub_popular-javascript-library-expr-eval-vulnerable-activity-7393745791384780800-1RIw

X/Twitter Security Alert https://x.com/securestep9/status/1987970226668138961

Rescana is here for you

At Rescana, we understand the critical importance of proactive third-party risk management and supply chain security. Our TPRM platform empowers organizations to continuously monitor, assess, and mitigate risks across their digital ecosystem, providing actionable intelligence and automated workflows to stay ahead of emerging threats. If you have questions about this advisory, need assistance with incident response, or require guidance on securing your software supply chain, our team is ready to help. Please contact us at ops@rescana.com.