expr-eval 1.0.1

Direct Vulnerabilities

Known vulnerabilities in the expr-eval package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Code Execution expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Code Execution via the `toJSFunction()` API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using `new Function()`. Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context. How to fix Code Execution? There is no fixed version for `expr-eval`.	*
C Prototype Pollution expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Prototype Pollution via the evaluation process, which accesses global values by searching for `item.value` in `expr.functions`. An attacker can access `prototype`, `__proto__`, `constructor`, and assign properties to it. Successful exploitation of this vulnerability can allow for arbitrary JavaScript execution by providing malicious expressions. Note: According to this comment development of `expr-eval` has been abandoned; with development continuing in `expr-eval-fork` How to fix Prototype Pollution? There is no fixed version for `expr-eval`.	*
C Prototype Pollution expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access `IMEMBER` and user-defined functions `IFUNDEF` in the expression evaluator. An attacker can execute arbitrary JavaScript code by providing malicious expressions and exploiting member access to reach dangerous built-in objects and functions. Note: The reporter did not receive a response from the project maintainers, and other prototype pollution issues have been reported without fixes released in the past, so a fix may not be forthcoming. How to fix Prototype Pollution? There is no fixed version for `expr-eval`.	*

Vulnerability

Vulnerable Version

Code Execution

expr-eval is a Mathematical expression evaluator

Affected versions of this package are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.

How to fix Code Execution?

There is no fixed version for expr-eval.

Prototype Pollution

expr-eval is a Mathematical expression evaluator

Affected versions of this package are vulnerable to Prototype Pollution via the evaluation process, which accesses global values by searching for item.value in expr.functions. An attacker can access prototype, __proto__, constructor, and assign properties to it. Successful exploitation of this vulnerability can allow for arbitrary JavaScript execution by providing malicious expressions.

Note: According to this comment development of expr-eval has been abandoned; with development continuing in expr-eval-fork

How to fix Prototype Pollution?

There is no fixed version for expr-eval.

Prototype Pollution

expr-eval is a Mathematical expression evaluator

Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access IMEMBER and user-defined functions IFUNDEF in the expression evaluator. An attacker can execute arbitrary JavaScript code by providing malicious expressions and exploiting member access to reach dangerous built-in objects and functions.

Note: The reporter did not receive a response from the project maintainers, and other prototype pollution issues have been reported without fixes released in the past, so a fix may not be forthcoming.

How to fix Prototype Pollution?

There is no fixed version for expr-eval.

expr-eval@1.0.1

Mathematical expression evaluator

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically