| Package | Affected versions | Patched versions |
|---|---|---|
| javascript expression evaluator | = 3.0.0 | |
| javascript expression evaluator | ≤ 2.0.2 | |
| expr-eval | ≤ 2.0.2 | |
| expr-eval-fork | < 3.0.1 | 3.0.1 |
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted variables object into the evaluate() function and trigger arbitrary code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free