« Volver al listado

CVE-2025-12735

Estado: AnalizadaCrítica (9.8)—

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N indica red sin autenticación. CWE-94 (improper control of generation of code) y descripción explícita de ejecución arbitraria de código mediante validación insuficiente en evaluate().

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (2)

Jorenbroekema — Javascript Expression EvaluatorSilentmatt — Javascript Expression Evaluator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-12735",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-12735",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-11-10T14:06:48.027568Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "silentmatt",
          "product": "expr-eval",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "2.0.2"
            }
          ]
        },
        {
          "vendor": "expr-eval-fork",
          "product": "expr-eval-fork",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "3.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-11-05T01:15:33.313",
  "references": [
    {
      "url": "https://github.com/advisories/GHSA-jc85-fpwf-qm7x",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/jorenbroekema/expr-eval",
      "tags": [
        "Product"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/silentmatt/expr-eval",
      "tags": [
        "Product"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/silentmatt/expr-eval/pull/288",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://kb.cert.org/vuls/id/263614",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.npmjs.com/package/expr-eval",
      "tags": [
        "Product"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.npmjs.com/package/expr-eval-fork",
      "tags": [
        "Product"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/263614",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/jorenbroekema/expr-eval/blob/460b820ba01c5aca6c5d84a7d4f1fa5d1913c67b/test/security.js",
      "tags": [
        "Product"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution."
    }
  ],
  "lastModified": "2026-06-17T08:32:52.150",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jorenbroekema:javascript_expression_evaluator:3.0.0:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDE513F1-E3F7-4FA9-BD2B-D310CA8853BD"
            },
            {
              "criteria": "cpe:2.3:a:silentmatt:javascript_expression_evaluator:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3236DF0B-3012-4193-82D6-9D73D24D723F",
              "versionEndIncluding": "2.0.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}