Bleepingcomputer Critical Vulnerability Discovered in expr-eval JavaScript Library
Article Content
Browse articles 
A critical vulnerability has been identified in the expr-eval JavaScript library, which has over 800,000 weekly downloads on NPM. This vulnerability, tracked as CVE-2025-12735, allows for remote code execution through maliciously crafted input, posing significant risks to applications that utilize this library. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has rated the severity of this issue as critical, with a score of 9.8.
Ask AI about this cluster
Answers cite the sources they use
Updated 228d ago How this analysis works
More articles in this cluster (2)
Following this threat?
Track CVE-2025-12735 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Rising Incomplete Security Patches Expose Vulnerabilities to Attackers Research from Terra Security reveals that security patches are increasingly becoming incomplete, acting as guides for attackers to exploit vulnerabilities. The rate of broken fixes has surged eightfold in 2026, with patches for known exploited bugs being reported as broken four times more often than others. Specific…