Prototype Pollution Vulnerability in expr-eval Package by npm

CVE-2025-13204

What is CVE-2025-13204?

The expr-eval package, commonly used in npm environments, is vulnerable to a prototype pollution attack. An attacker with access to the express eval interface can manipulate the JavaScript prototype chain, potentially resulting in arbitrary code execution. To mitigate this risk, it is recommended to migrate to the expr-eval-fork package, which addresses this security concern.

References