CVE-2026-12866CWE-94

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API

Critical · published June 23, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00866 · 58.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-06-23T05:00Z
EPSS history
Timeline
  • 23 JUN 05:00Z
    All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API
    cvelistv5