CVE-2025-13204
High · 7.3expr-eval vulnerable to Prototype Pollution
CVSS
7.3
EPSS
0.5%
Published
Nov 14, 2025
CISA due date
—
The record
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | expr-eval | 0 | No fix |
| npm | expr-eval-fork | 0 | 2.0.2 |
| Chainguard | librechat | 0 | 0.8.1-r0 |
| Chainguard | librechat-compat | 0 | 0.8.0-r4 |
| Chainguard | librechat-dev | 0 | 0.8.0-r4 |
Related vulnerabilities
- GHSA-8gw3-rxh4-v6jx expr-eval vulnerable to Prototype Pollution Same vulnerability
- GHSA-jc85-fpwf-qm7x expr-eval does not restrict functions passed to the evaluate function Also affects expr-eval
- CVE-2025-12735 The expr-eval library is a JavaScript expression parser and evaluator designed to safely… Also affects expr-eval
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects librechat
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects librechat
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Also affects librechat
- CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… Also affects librechat
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat