CVE-2025-13204

Vulnerability

Analysis

The expr-eval npm package, a mathematical expression evaluator for JavaScript, is susceptible to a Prototype Pollution vulnerability (CVE-2025-13204). By exploiting JavaScript’s prototype-based inheritance model, an attacker can inject properties into the global Object.prototype through crafted expressions. The root cause lies in how the parser handles user-supplied variables during expression evaluation, which does not adequately prevent modification of built-in prototypes [1][2][3].

Attack

Vector & Prerequisites

An attacker must have network access to an application that uses expr-eval to evaluate untrusted expressions via the Express JS interface. No special authentication is required if the vulnerable endpoint is publicly exposed. By providing a malicious expression containing special property assignments (e.g., __proto__), the attacker can pollute the global prototype chain. This can be triggered through the evaluate method or the simplify method when passing variables [1][2][3].

Impact

Successful exploitation leads to arbitrary code execution in the context of the Node.js application. Prototype Pollution can alter the behavior of all objects in the runtime, enabling attacks such as command injection, server-side request forgery (SSRF), or further privilege escalation. The CVSS score indicates high severity due to the combination of network attack vector and the potential for full system compromise [3].

Mitigation

The vulnerability is not patched in the original expr-eval package. The recommended fix is to migrate to the forked package expr-eval-fork, which includes the security commit that was never released to npm [1][2]. Users should update their package.json dependencies accordingly and audit any applications that evaluate user-supplied expressions.