CVE-2026-12866
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The vulnerability in the expr-eval library allows arbitrary JavaScript code execution via the toJSFunction() API. An attacker can supply crafted expressions that are compiled into native code using new Function(), bypassing the intended expression sandbox and executing arbitrary code within the application's context.
Risk Assessment
The risk for the organization includes full application compromise, data theft, data modification or deletion, and potential lateral movement to other systems within the internal network.
Recommendation
It is recommended to immediately update the expr-eval library to the latest version that fixes this vulnerability. If an update is not possible, discontinue use of the toJSFunction() API or implement additional input validation and isolation mechanisms.
Original NVD description (English source)
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.