{"action":"Upgrade expr-eval-fork to 3.0.1 or later.","affected":[{"fixed":"3.0.1","introduced":"0"}],"component":"expr-eval-fork","cve_ids":["CVE-2025-12735"],"ecosystem":"npm","epss":0.01761,"exploited":false,"fixed_versions":["3.0.1"],"ghsa_id":"GHSA-jc85-fpwf-qm7x","id":"tcs_01M5KFXNA89FC6XBRZN7XT4283","modified_at":"2026-09-10T03:50:31.031027873Z","published_at":"2025-11-05T03:30:23Z","references":["https://osv.dev/vulnerability/GHSA-jc85-fpwf-qm7x","https://nvd.nist.gov/vuln/detail/CVE-2025-12735","https://github.com/silentmatt/expr-eval/pull/288","https://github.com/silentmatt/expr-eval/pull/289","https://github.com/jorenbroekema/expr-eval/commit/1d71bb2ca8f98df8de00e9cc4de8fdd468a7ad43","https://github.com/jorenbroekema/expr-eval","https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js","https://github.com/silentmatt/expr-eval","https://kb.cert.org/vuls/id/263614","https://www.kb.cert.org/vuls/id/263614","https://www.npmjs.com/package/expr-eval","https://www.npmjs.com/package/expr-eval-fork"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-jc85-fpwf-qm7x#npm/expr-eval-fork","url":"https://osv.dev/vulnerability/GHSA-jc85-fpwf-qm7x"},{"source":"nvd","source_id":"CVE-2025-12735","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12735"}],"summary":"expr-eval does not restrict functions passed to the evaluate function"}