PT-2025-46975 · Pypi · Expr-Eval

Published 2025-11-14 · Updated 2026-01-24 · CVE-2025-13204

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions npm package expr-eval (affected versions not specified)

Description The npm package expr-eval is susceptible to a Prototype Pollution issue. An attacker who can access the express eval interface may leverage the JavaScript prototype-based inheritance model to potentially achieve arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-13204

GHSA-8GW3-RXH4-V6JX

RHSA-2026:0140

Affected Products

Expr-Eval

References · 17

• 🔥 https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py · Exploit
• 🔥 https://huntr.dev/bounties/1-npm-expr-eval · Exploit
• https://github.com/silentmatt/expr-eval/pull/252/files · Patch
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-13204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13204 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13204 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8gw3-rxh4-v6jx · Vendor Advisory
• https://github.com/silentmatt/expr-eval · Note
• https://github.com/silentmatt/expr-eval/commit/6e889e0e75c50ac37d70c35388602025650e0c50 · Note
• https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py · Note
• https://github.com/jorenbroekema/expr-eval · Note
• https://github.com/jorenbroekema/expr-eval/commit/6c475a118643ae0efe012de283e932fb8b74324b · Note
• https://t.me/avleonovcom/1626 · Telegram Post
• https://t.me/cveNotify/142874 · Telegram Post
• https://npmjs.com/package/expr-eval-fork · Note