CVE-2026-12866

Name of the Vulnerable Software and Affected Versions expr-eval (affected versions not specified)

Description Code Execution is possible via the 'toJSFunction()' API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context. This issue affects approximately 800,000 weekly npm downloads and requires no authentication or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the 'toJSFunction()' API until a patch is available.