github.com/expr-lang/expr (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/expr-lang/expr, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2025-29786 — CVSS 7.5 (high): Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an…
• CVE-2025-68156 — CVSS 7.5 (high): Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including…