| Package | Affected versions | Patched versions |
|---|---|---|
| expr-eval | ≤ 2.0.2 | |
| expr-eval-fork | < 2.0.2 | 2.0.2 |
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free