expr-eval (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package expr-eval, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2025-12735 — CVSS 9.8 (critical): The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with…
• CVE-2025-13204 — CVSS 7.3 (high): npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript…