CVE-2025-13204
🟡 Monitoruj
Zanieczyszczenie prototypu w pakiecie npm expr-eval umożliwia zdalne wykonanie kodu.
CVSS
7.3
EPSS
0.4%
Exploit
poc
Vendor
silentmatt
Opis źródłowy (NVD)
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
exploit rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.4% |
| Opublikowano (NVD) | 2025-11-14 17:16:01 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-07 21:10:00 UTC |
Referencje
- https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py ([email protected]) [Product]
- https://github.com/jorenbroekema/expr-eval ([email protected]) [Product]
- https://github.com/silentmatt/expr-eval ([email protected]) [Product]
- https://github.com/silentmatt/expr-eval/pull/252/files ([email protected]) [Issue Tracking, Patch]
- https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py ([email protected]) [Product]
- https://www.huntr.dev/bounties/1-npm-expr-eval/ ([email protected]) [Exploit, Third Party Advisory]
- https://www.npmjs.com/package/expr-eval-fork ([email protected]) [Product]