CVE-2026-12866: expr-eval: code injection via toJSFunction()
CVE-2026-12866 affects the expr-eval JavaScript package, where the toJSFunction() API can turn user-supplied expressions into native code through new Function(). The record rates it critical, with a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.2 from Snyk, and classifies it as CWE-94 (code injection). It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-12866 is a code injection issue in the expr-eval JavaScript package. According to the record, the toJSFunction() API compiles user-controlled expressions into native code using new Function(), so the expression evaluation boundary can be bypassed. The CNA is Snyk, and the record is currently in Deferred status.
Impact
- The record describes arbitrary JavaScript execution within the context of the host application.
- Snyk's CVSS 3.1 score is 9.8 (critical), and its CVSS 4.0 score is 9.2.
- Under the CVSS 3.1 vector in the record, confidentiality, integrity and availability are all rated high, with no privileges or user interaction required. The practical impact depends on how the application exposes the affected API.
Affected products and versions
- The description states that all versions of expr-eval are affected.
- The record contains no structured list of affected or fixed version ranges, so specific version boundaries cannot be confirmed from the sources consulted.
- The referenced Snyk entries include a Java WebJars npm package entry, which suggests downstream packaging, but the record does not detail the affected versions there.
Exploitation status
- The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
- No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Check whether your applications or dependencies include expr-eval, directly or through transitive packages.
- Treat any use of expression evaluation with untrusted input as high risk until a vendor fix or a verified upgrade path is confirmed.
- Reduce exposure by restricting which users or services can submit expressions, validating input, and running evaluation in isolated, least-privilege processes.
- Monitor the upstream project issue and the Snyk advisories for fix details, since the record does not list a fixed version.
Detection guidance
- Inventory package manifests and lock files for expr-eval and bundled copies in web assets or Java WebJars.
- Review application logs for unusual expression inputs or unexpected process or network activity originating from the application process.
- Alert on evaluation endpoints receiving unusually complex or unexpected input patterns.
Limitations of the available information
- The record gives no fixed version, no list of affected version ranges and no vendor patch.
- The exploitation status is limited to the absence of a KEV listing and the lack of exploitation details in the sources consulted.
- EPSS and SSVC data are not available in the record.
Frequently asked questions
What is CVE-2026-12866?
It is a critical code injection issue (CWE-94) in the expr-eval JavaScript package, where the toJSFunction() API compiles user-controlled expressions into executable code using new Function().
Is CVE-2026-12866 being actively exploited?
It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record does not provide further exploitation details.
Which versions are affected and is there a fix?
The description states that all versions of expr-eval are affected. The record lists no fixed version, so the fix status must be verified with the vendor or the referenced advisories.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.