What is the CVSS score of CVE-2026-12866?

CVE-2026-12866 has a contested CVSS base score of 9.2 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of expr-eval are affected by CVE-2026-12866?

The expr-eval npm package (all released versions) contains a critical remote code execution vulnerability (CVE-2026-12866, CVSS 9.2) that allows arbitrary JavaScript execution in application…

How to fix or mitigate CVE-2026-12866?

Within 24 hours: Conduct complete dependency audit across all code repositories and environments to identify every application consuming expr-eval; flag all production instances for emergency assessment and apply principle of least privilege to service accounts. Within 7 days: Either remove expr-eval as a dependency entirely, or if toJSFunction() is not used, disable that specific API and migrate to safe alternatives (such as property-accessor-only approaches); implement network segmentation isolating any affected services that cannot be immediately remediated. Within 30 days: Complete migration away from expr-eval to alternative expression evaluation libraries with secure defaults; perform forensic analysis of affected production logs for signs of prior exploitation; implement runtime detection for eval and Function constructor invocations.

expr-eval CVE-2026-12866

EUVD-2026-38415 CRITICAL

Code Injection (CWE-94)

2026-06-23 snyk

GHSA-q9v2-7m5w-4693

RCE Code Injection N A Expr Eval

Critical

Disputed · 9.2 Vendor: snyk

Severity by source

Sources disagree (Low–Critical)

Vendor (snyk) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable API with no auth or interaction once the app exposes toJSFunction() to user input; full RCE yields high C/I/A within the same process scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

4.2 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: snyk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 05:28 vuln.today

CVSS changed

Jun 23, 2026 - 05:22 NVD

9.8 (CRITICAL) 9.2 (CRITICAL)

DescriptionCVE.org

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.

AnalysisAI

Arbitrary JavaScript code execution in the expr-eval npm package affects all released versions when applications pass user-controlled expressions to the toJSFunction() API, which compiles them via new Function() and executes them in the host process context. Snyk discloses no public exploit identified at time of analysis, but the trivial attack pattern (sandbox escape via crafted math expressions) and CVSS 4.0 score of 9.2 make this a high-priority issue for any Node.js or browser application that exposes expr-eval to untrusted input.

Technical ContextAI

expr-eval is a JavaScript expression parser/evaluator originally written by silentmatt, commonly embedded in Node.js services, dashboards, and rules engines to let users supply mathematical or logical formulas. The vulnerable toJSFunction() helper takes the parsed AST and concatenates it into a JavaScript source string that is then handed to the built-in Function constructor, which is functionally equivalent to eval(). This is a textbook CWE-94 (Improper Control of Generation of Code) flaw: the library's tokenizer was designed to restrict syntax to expression-language operators, but because the final compilation step reaches the full JavaScript runtime, any payload that survives the tokenizer (or abuses operator/identifier handling in expression.js around line 55) escapes the intended sandbox and runs with the privileges of the host process.

RemediationAI

No vendor-released patch identified at time of analysis - the linked GitHub issue (#292) and the Snyk advisory do not cite a fixed version, so consumers should treat this as unpatched and act at the application layer. The most reliable compensating control is to stop calling toJSFunction() entirely and use Expression.evaluate() with a constrained variable scope, accepting the performance trade-off of interpreted rather than compiled evaluation. If toJSFunction() must remain, restrict its inputs to expressions authored by trusted operators (never end users), enforce a strict allowlist of identifiers and operators before parsing, and run the evaluator inside an isolated context such as vm2's successor isolated-vm or a separate Worker with no access to require, process, or globalThis; note that isolated-vm adds deployment complexity and Workers still share Node primitives unless explicitly stripped. Consider migrating to maintained alternatives such as mathjs (with its evaluate() in a scoped object) or filtrex, both of which avoid new Function() on user input.