Kritik CVSS 9.8
CVE-2025-12735: Javascript Expression Evaluator: kod enjeksiyonu
Açıklama (NVD)
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Özet bilgiler
- Ürün
- Jorenbroekema Javascript Expression Evaluator
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %1,76 (yüzdelik 78)
- CWE
- CWE-94
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| jorenbroekema-javascript-expression-evaluator | 3.0.0 | 3.0.0 | — |
| silentmatt-javascript-expression-evaluator | — | 2.0.2 | — |