p PatchFirst

PatchFirst · Latest vulnerabilities

org.webjars.npm:expr-eval vulnerabilities

Vulnerabilities published for org.webjars.npm:expr-eval in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-12866

    Critical · CVSS 9.2EPSS 0.87%No fix published

    CVE-2026-12866

    All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.

    org.webjars.npm:expr-eval
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →