{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.0.2"}],"component":"org.webjars.npm:expr-eval","cve_ids":["CVE-2026-12866"],"ecosystem":"Maven","epss":0.00866,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-q9v2-7m5w-4693","id":"tcs_01M5N996SJP5Y37N51KREYAMTY","modified_at":"2026-09-22T14:45:10.513483389Z","published_at":"2026-06-23T06:30:41Z","references":["https://osv.dev/vulnerability/GHSA-q9v2-7m5w-4693","https://nvd.nist.gov/vuln/detail/CVE-2026-12866","https://github.com/silentmatt/expr-eval/issues/292","https://github.com/silentmatt/expr-eval","https://github.com/silentmatt/expr-eval/blob/master/src/expression.js#L55","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17662018","https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-q9v2-7m5w-4693#Maven/org.webjars.npm:expr-eval","url":"https://osv.dev/vulnerability/GHSA-q9v2-7m5w-4693"}],"summary":"expr-eval vulnerable to Code Execution"}