Description (CNA)
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| silentmatt / expr-eval | affected 0 through 2.0.2 |
| expr-eval-fork / expr-eval-fork | affected 0 through 3.0.0 |
CWE
No CWE identifiers supplied.
References
- https://github.com/silentmatt/expr-eval
- https://github.com/jorenbroekema/expr-eval
- https://www.npmjs.com/package/expr-eval-fork
- https://www.npmjs.com/package/expr-eval
- https://github.com/silentmatt/expr-eval/pull/288
- https://github.com/advisories/GHSA-jc85-fpwf-qm7x
- https://kb.cert.org/vuls/id/263614
ADP enrichment
No English description supplied.
No English description supplied.