Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-12866: Expr-eval: Unrestricted JavaScript Execution via User Input
CVE-2026-12866
Summary
All versions of the expr-eval package are affected. This means an attacker could potentially run malicious code within your application if they can influence the input that expr-eval processes. Update to a fixed version of expr-eval to prevent this risk.
Original title
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled in...
Original description
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.
nvd CVSS3.1
9.8
nvd CVSS4.0
9.2
Vulnerability type
CWE-94
Code Injection
Published: 23 Jun 2026 · Updated: 23 Jul 2026 · First seen: 23 Jun 2026