[GHSA-jc85-fpwf-qm7x] expr-eval does not restrict functions passed to the evaluate function

[alecasg555]

Updates

• Affected products

Comments

Mitigation Solution: safe-expr-eval

I've developed safe-expr-eval as a secure drop-in replacement that completely addresses CVE-2025-12735 while maintaining 100% API compatibility with expr-eval.

Why safe-expr-eval is secure:

✅ No eval() - Never uses JavaScript's dangerous eval() function
✅ No Function constructor - Doesn't dynamically create executable code
✅ Token-based parsing - Expressions are parsed into safe tokens and evaluated in a controlled environment
✅ Type-safe - Built with TypeScript for additional security guarantees
✅ Zero dependencies - Minimal attack surface

Migration is trivial:

// Before (vulnerable)
const { Parser } = require('expr-eval');

// After (secure)
const { Parser } = require('safe-expr-eval');

// That's it! All your existing code works unchanged.