CVE-2026-12866 — Vulnerability in org.webjars.npm:expr-eval — CVE...

CRITICAL

expr-eval vulnerable to Code Execution

Published June 23, 2026Updated September 22, 2026Source: osv

Summary

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.

Advisory Timeline

First published June 23, 2026 (111 days ago).
Last revised September 22, 2026 — 91 days after initial publication.

Affected Packages (2)

Affects 2 ecosystems: maven (1), npm (1).

Package	Ecosystem	Affected	Fixed In
org.webjars.npm:expr-eval	maven	2.0.2	Range-based data available
expr-eval	npm	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-12866?: expr-eval vulnerable to Code Execution This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-12866?: CVE-2026-12866 affects org.webjars.npm:expr-eval and expr-eval. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-12866 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-q9v2-7m5w-4693

Related CVEs

CVE-2024-21534
CRITICAL
JSONPath Plus Remote Code Execution (RCE) Vulnerability
CVE-2016-10707
HIGH
Denial of Service in jquery
CVE-2019-11358
MEDIUM
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
CVE-2021-41182
MEDIUM
XSS in the `altField` option of the Datepicker widget in jquery-ui
CVE-2021-41184
MEDIUM
XSS in the `of` option of the `.position()` util in jquery-ui
CVE-2016-7103
MEDIUM
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
CVE-2021-41183
MEDIUM
XSS in `*Text` options of the Datepicker widget in jquery-ui
CVE-2020-11023
MEDIUM
Potential XSS vulnerability in jQuery

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies