CVE-2025-13204: Prototype Pollution Vulnerability in npm `expr-eval` Leads to Potential Code Execution

Overview

CVE-2025-13204 details a Prototype Pollution vulnerability found in the widely used npm package expr-eval. This vulnerability allows an attacker with access to the expression evaluation interface to leverage JavaScript’s prototype-based inheritance model to potentially achieve arbitrary code execution on the affected system. A patched version is available in the expr-eval-fork package.

Technical Details

Prototype Pollution occurs when an attacker can manipulate the properties of JavaScript’s built-in object prototypes (e.g., Object.prototype). By modifying these prototypes, the attacker can inject malicious code that will be inherited by all objects created using that prototype. In the context of expr-eval, if the library is used in a way that allows user-controlled input to influence the expression evaluation process, an attacker could inject malicious properties into the prototype chain, leading to unexpected and potentially harmful behavior, including arbitrary code execution.

The vulnerability stems from insufficient input validation and sanitization when evaluating expressions. Specifically, the library’s handling of property assignment within evaluated expressions allows for the modification of object prototypes.

CVSS Analysis

Currently, a CVSS score is not available (N/A) for CVE-2025-13204. However, given the potential for arbitrary code execution through Prototype Pollution, the severity is likely to be considered high. A thorough risk assessment is crucial for any application utilizing the affected version of expr-eval.

Possible Impact

The impact of CVE-2025-13204 can be significant. If successfully exploited, an attacker could:

• Achieve arbitrary code execution on the server or client-side, depending on where the expr-eval library is used.
• Gain unauthorized access to sensitive data.
• Modify application behavior to compromise security or functionality.
• Launch denial-of-service attacks.

Mitigation or Patch Steps

To mitigate the risks associated with CVE-2025-13204, the following steps are recommended:

1. Upgrade: Migrate your project to use the expr-eval-fork package. This fork resolves the Prototype Pollution vulnerability.
2. Input Validation: If upgrading is not immediately feasible, implement rigorous input validation and sanitization to prevent attackers from injecting malicious properties into evaluated expressions. However, this approach is less reliable than upgrading.
3. Contextualization: Evaluate the context in which expr-eval is used within your application. Determine if user-controlled input can influence the expression evaluation process.

References

GitHub Repository: jorenbroekema/expr-eval
GitHub Repository: silentmatt/expr-eval (Original Repository)
npm Package: expr-eval-fork