CVE-2025-12735
Critical · 9.8CVSS
9.8
EPSS
1.8%
Published
Nov 5, 2025
CISA due date
—
The record
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | expr-eval | 0 | No fix |
| npm | expr-eval-fork | 0 | 3.0.1 |
| Chainguard | librechat | 0 | 0.8.1-r0 |
| Chainguard | librechat-compat | 0 | 0.8.0-r3 |
| Chainguard | librechat-dev | 0 | 0.8.0-r3 |
Related vulnerabilities
- GHSA-jc85-fpwf-qm7x expr-eval does not restrict functions passed to the evaluate function Same vulnerability
- GHSA-8gw3-rxh4-v6jx expr-eval vulnerable to Prototype Pollution Also affects expr-eval
- CVE-2025-13204 expr-eval vulnerable to Prototype Pollution Also affects expr-eval
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects librechat
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects librechat
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Also affects librechat
- CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… Also affects librechat
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat