CVE-2025-13204
📋 TL;DR
The npm package `expr-eval` is vulnerable to prototype pollution, allowing attackers to modify JavaScript object prototypes. This can lead to arbitrary code execution if an attacker can access the expression evaluation interface. Any application using vulnerable versions of this package is affected.
💻 Affected Systems
- npm expr-eval package
📦 What is this software?
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Application compromise allowing data manipulation, privilege escalation, and potential access to underlying server resources.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only denial of service or application errors.
🎯 Exploit Status
Proof-of-concept exists in CTF challenges; exploitation requires attacker to control expression input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: expr-eval-fork package (patched version)
Vendor Advisory: https://github.com/silentmatt/expr-eval/pull/252/files
Restart Required: Yes
Instructions:
1. Update package.json to use expr-eval-fork instead of expr-eval. 2. Run npm install expr-eval-fork. 3. Update import statements from 'expr-eval' to 'expr-eval-fork'. 4. Restart the application.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject expressions containing prototype pollution patterns
Sandbox Expression Evaluation
allRun expr-eval in isolated environment or container with limited permissions
🧯 If You Can't Patch
- Implement WAF rules to block prototype pollution patterns in expression inputs
- Disable or remove expr-eval functionality if not essential to application
🔍 How to Verify
Check if Vulnerable:
Check package.json for 'expr-eval' dependency and verify version is not the patched forkCheck Version:
npm list expr-eval && npm list expr-eval-forkVerify Fix Applied:
Verify package.json uses 'expr-eval-fork' and test with known malicious expressions📡 Detection & Monitoring
Log Indicators:
- Unusual expression patterns with __proto__ or constructor properties
- Application errors related to prototype modification
Network Indicators:
- HTTP requests containing JavaScript prototype pollution patterns in expression parameters
SIEM Query:
search 'expr-eval' AND ('__proto__' OR 'constructor' OR 'prototype') in web logs🔗 References
- https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py
- https://github.com/jorenbroekema/expr-eval
- https://github.com/silentmatt/expr-eval
- https://github.com/silentmatt/expr-eval/pull/252/files
- https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py
- https://www.huntr.dev/bounties/1-npm-expr-eval/
- https://www.npmjs.com/package/expr-eval-fork
