CVE-2025-12735: 
JavaScript vulnerability analysis and mitigation

CVE-2025-12735 is a code injection vulnerability in the expr-eval JavaScript expression parser and evaluator library that allows attackers to trigger arbitrary code execution by passing a crafted context object or exploiting MEMBER access within the evaluate() function. It was disclosed on November 4–5, 2025, by CERT/CC. Affected packages include expr-eval (npm, versions ≤ 2.0.2 by silentmatt) and expr-eval-fork (npm, versions ≤ 3.0.0 by jorenbroekema). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) as assessed by CISA-ADP (Github Advisory, Feedly).

The root cause is insufficient input validation (CWE-94: Improper Control of Generation of Code) in the evaluate() function, which fails to restrict what functions or object members can be passed via the variables/context object. Because the library supports user-defined functions and property access (MEMBER operator), an attacker can supply a crafted context object containing JavaScript functions — such as references to process.mainModule.require or similar Node.js globals — that are then invoked during expression evaluation, resulting in arbitrary code execution. The attack is network-accessible, requires no authentication or user interaction, and exploits the library's design of allowing custom JavaScript functions to be bound to expression variables (Github Advisory, Security Patch PR). A related prototype pollution issue (CVE-2025-13204) was also identified in expr-eval (not expr-eval-fork) that can lead to RCE without requiring a crafted context (Security Patch PR).

Successful exploitation grants an attacker full remote code execution on the host running the vulnerable Node.js application, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive data, modify application state, install backdoors, or crash the service entirely. Applications using expr-eval or expr-eval-fork in AI, NLP, workflow automation (e.g., n8n), and formula-processing contexts are particularly at risk, as these commonly expose the evaluate() function to user-controlled input (Feedly, Github Advisory).

Multiple public proof-of-concept exploits are available on GitHub, including repositories specifically targeting this CVE (PoC 1, PoC 2). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made (Feedly). The EPSS score is approximately 0.074–0.116%, indicating a relatively low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (detection ID 385911) (Feedly).

1. Reconnaissance: Identify applications using expr-eval or expr-eval-fork npm packages (versions ≤ 2.0.2 or ≤ 3.0.0 respectively) that expose expression evaluation to user-controlled input — common in formula engines, AI/NLP pipelines, and workflow automation tools like n8n.
2. Identify the attack surface: Locate API endpoints or input fields that pass user-supplied data as variables or context objects to Parser.evaluate() or expr.evaluate().
3. Craft a malicious context object: Construct a context object where a variable is bound to a dangerous JavaScript function or uses MEMBER access to reach Node.js globals. For example, pass a context object where a variable resolves to process.mainModule.require('child_process').execSync.
4. Inject the payload: Submit the crafted expression and context to the vulnerable endpoint. For example: Parser.evaluate('cmd("id")', { cmd: require('child_process').execSync }) — the library will invoke the function during evaluation without restriction.
5. Achieve code execution: The injected function executes arbitrary OS commands in the context of the Node.js process, enabling data exfiltration, reverse shell establishment, or further lateral movement (Github Advisory, Security Patch PR).

• Logs: Unexpected Node.js process errors or stack traces referencing evaluate() or expression parsing with unusual variable names; application logs showing evaluation of expressions containing process, require, child_process, or exec keywords.
• Process: Unusual child processes spawned by the Node.js application process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Network: Unexpected outbound connections from the Node.js server to external IPs, particularly on non-standard ports, following expression evaluation requests; unusual DNS lookups from the application host.
• File System: New or modified files in the application directory or temp directories created by the Node.js process; presence of web shells, reverse shell scripts, or unauthorized cron jobs/scheduled tasks.
• Application Behavior: Errors or anomalous responses from API endpoints that accept expression or formula input, particularly those returning unexpected data or timing anomalies consistent with command execution.

For expr-eval-fork (jorenbroekema), upgrade to version 3.0.1 or later, which includes the security patch (Github Advisory). For the original expr-eval (silentmatt), no patched npm release has been published as of the advisory date; the security fix is available in pull request #288 but remains unmerged — organizations should monitor the repository or migrate to expr-eval-fork ≥ 3.0.1 (Security Patch PR). As an interim workaround, implement strict allowlisting of variables and context objects passed to evaluate(), ensuring no JavaScript functions or prototype-chain-accessible properties are included. Consider temporarily disabling or restricting access to any functionality that invokes evaluate() with user-controlled input until patching is complete (Feedly).

The vulnerability received notable media coverage, with BleepingComputer, GBHackers, CyberSecurityNews, TechRadar, and SC World all reporting on the RCE risk to AI and NLP applications (BleepingComputer). Docker published a blog post describing their upstream approach to addressing CVE-2025-12735 in their ecosystem (Docker Blog). The n8n workflow automation platform released patched versions (1.120.2 and 1.121.0) that address the vulnerability. CERT/CC's Vijay Sarvepalli led the coordinated disclosure effort and submitted the security patch PR, noting difficulty reaching the original maintainers. Community discussion on GitHub highlighted a related prototype pollution issue (CVE-2025-13204) and referenced a prior SECCON CTF 2022 challenge that demonstrated expr-eval-based RCE, underscoring that the attack surface was known in research circles before formal disclosure (Security Patch PR).