What is the CVSS score of CVE-2025-12735?

CVE-2025-12735 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Javascript Expression Evaluator are affected by CVE-2025-12735?

Organizations using expr-eval library face critical risk from CVE-2025-12735, a code injection vulnerability rated CVSS 9.8.. A patch is available.

Is there a public PoC exploit available for CVE-2025-12735?

Yes, a public proof-of-concept exploit is available for CVE-2025-12735. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-12735?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Javascript Expression Evaluator CVE-2025-12735

CRITICAL

Code Injection (CWE-94)

2025-11-05 cret@cert.org

RCE Code Injection Javascript Expression Evaluator Red Hat

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

9.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

Patch released

Mar 28, 2026 - 19:20 nvd

Patch available

CVE Published

Nov 05, 2025 - 01:15 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,371 npm packages depend on expr-eval (262 direct, 1,112 indirect)
2 npm packages depend on expr-eval-fork (1 direct, 1 indirect)

Ecosystem-wide dependent count for version 2.0.2 and other introduced versions.

DescriptionCVE.org

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

AnalysisAI

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution. Affected products include: Jorenbroekema Javascript Expression Evaluator, Silentmatt Javascript Expression Evaluator.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.

Vendor StatusVendor

CVE-2025-12735 vulnerability details – vuln.today

Back

Javascript Expression Evaluator CVE-2025-12735

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Vendor StatusVendor

Share

External POC / Exploit Code