CVE-2025-12735
Published: 05 November 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-12735, published on 2025-11-05, affects the expr-eval JavaScript library, an expression parser and evaluator designed to safely process mathematical expressions with user-defined variables. The vulnerability arises from insufficient input validation, enabling an attacker to supply a crafted context object or leverage a MEMBER of the context object within the evaluate() function to trigger arbitrary code execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-94 (Code Injection).
Any unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation grants arbitrary code execution in the context of the application using the library, resulting in high-impact compromise of confidentiality, integrity, and availability.
Advisories such as GHSA-jc85-fpwf-qm7x and CERT KB 263614 document the issue, while repositories for expr-eval (jorenbroekema/expr-eval and silentmatt/expr-eval) and pull request #288 provide details on patches to address the input validation flaw, recommending updates to mitigated versions of the library.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability enables unauthenticated remote code execution in a JavaScript expression evaluator library, directly facilitating T1190 (Exploit Public-Facing Application) via network-accessible input and T1059.007 (JavaScript) for arbitrary code execution through the abused interpreter.