CVE-2025-13204
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-14

Last updated on: 2025-11-18

Assigner: CERT/CC

Description
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-14
Last Modified
2025-11-18
Generated
2026-06-16
AI Q&A
2025-11-14
EPSS Evaluated
2026-06-14
NVD
CVE-2025-13204
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
silentmatt expr-eval *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, you should replace the vulnerable npm package `expr-eval` with the patched version available in the `expr-eval-fork` package.

Executive Summary

The vulnerability in the npm package `expr-eval` is a Prototype Pollution issue. This means an attacker who can access the expression evaluation interface can manipulate JavaScript's prototype-based inheritance to execute arbitrary code.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code on your system if they have access to the expression evaluation interface, potentially leading to unauthorized actions or system compromise.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart