CVE-2025-12735

Executive Summary

CVE-2025-12735 is a critical code injection vulnerability (CWE-94) affecting the expr-eval JavaScript library, a popular expression parser and evaluator used to process mathematical and logical expressions with user-defined variables. The vulnerability stems from insufficient input validation, allowing an attacker to pass a crafted context object — or leverage the MEMBER accessor of the context object — into the evaluate() function to trigger arbitrary JavaScript code execution. Any application integrating expr-eval to evaluate untrusted expressions or accepting user-controlled context objects is potentially affected. Successful exploitation can lead to full remote code execution (RCE) in the context of the running Node.js or browser application, enabling data theft, lateral movement, and complete system compromise. Patch details are claimed but not independently confirmed (confidence 2/4), and no public exploit code or CISA KEV listing exists at the time of writing.

Technical Analysis

The expr-eval library is a JavaScript-based expression parser and evaluator designed to safely interpret mathematical expressions while allowing developers to inject user-defined variables through a context object. The intended security boundary is that only the expressions themselves — and not the surrounding JavaScript runtime — should be reachable by an attacker. CVE-2025-12735 breaks this boundary.

The root cause is classified as CWE-94: Improper Control of Generation of Code ('Code Injection'). According to the NVD description, the library performs insufficient input validation on two attack surfaces:

1. Crafted context objects — The evaluate() function accepts a second argument (the context) that maps variable names to values. If an attacker can influence the structure or content of this context object — for example, by supplying a deeply nested object with special property names, getters, or prototype-polluting keys — the library's internal processing can be coerced into executing attacker-controlled JavaScript code rather than merely reading values.

2. MEMBER expressions on context objects — The expr-eval grammar supports MEMBER access (e.g., var1.property.subProperty). When the evaluator resolves a MEMBER chain against the user-supplied context, the resolved value's property lookup path is insufficiently validated. An attacker who controls the expression string (a common use case in rule engines, calculators, or dynamic filtering systems) can craft expressions that cause the evaluator to traverse into restricted JavaScript object internals — such as constructor, __proto__, or function constructors — thereby escaping the expression sandbox and reaching native JavaScript execution primitives.

The vulnerability class is a sandbox escape via expression-language misinterpretation, closely resembling prototype pollution–driven RCE or expression-injection flaws. The NVD description does not identify a specific vulnerable version range, an exact vulnerable function beyond the evaluate() entry point, or a confirmed patch version — this limitation is noted per accuracy rules. However, the attack mechanism is clear: any evaluation path where attacker-controlled data reaches the evaluate() function either as the expression string (permitting MEMBER abuse) or as the context object argument (permitting crafted-object injection) is exploitable.

Affected runtime environments include Node.js server-side deployments, Electron applications, and browser-based JavaScript applications that bundle expr-eval. Given the library's purpose — safe evaluation of dynamic expressions — it is typically found in low-code platforms, business-rule systems, data-analysis dashboards, and configuration-driven applications. The lack of a disclosed CVSS vector score and the absence of version range data in the CVE record reduce forensic precision, though this does not diminish the severity: code injection in a JavaScript evaluation library is a critical-class flaw with a direct path to remote code execution.

Exploitation Scenarios

Given the NVD description and available data, no public PoC or active exploitation campaign has been documented. The attack chain below is therefore inferred from the vulnerability class and the documented attack mechanism (crafted context object / MEMBER abuse via evaluate()). No specific function names, endpoints, or code patterns beyond those in the NVD description (evaluate(), context object, MEMBER) are invented.

Prerequisite profile: An application that (1) exposes the expr-eval evaluate() function directly or indirectly to user input, and (2) allows the user to influence either the expression string or the context object argument. Common exposure points: HTTP APIs that accept expression payloads, admin panels with rule-builder features, or client-side calculators with dynamic formula input.

Step 1 — Reconnaissance / target identification. An attacker identifies the application as a user of expr-eval. This may be determined through JavaScript bundle analysis (searching for expr-eval package markers or characteristic error messages), documentation disclosure, or by probing expression-evaluation endpoints with benign payloads to observe parser behavior (e.g., sending an obviously invalid expression and matching the resulting error format against expr-eval's known error signatures).

Step 2 — Triggering the flaw. The attacker submits a request to the endpoint that accepts either:

• A crafted context object passed alongside an expression — e.g., an API payload where the JSON body contains a context parameter whose nested structure includes special JavaScript property names that the evaluator processes unsafely; or
• An expression string containing MEMBER chains that reference sensitive properties of the context object — e.g., expressions that navigate from a legitimate context variable into inherited or global JavaScript object properties.

Because the flaw is in validation, the attacker's objective is to make the evaluator resolve a reference that lands on a JavaScript function constructor or executable property rather than a plain data value.

Step 3 — Payload / execution method. At the vulnerability-class level, the attacker leverages the code-injection primitive to achieve arbitrary JavaScript execution. In sandbox-escaping expressions, this is commonly accomplished by constructing a payload that traverses contextProperty.constructor.constructor(...) semantics — where constructor resolves to the Function constructor and the inner argument is a string of attacker-controlled JavaScript code — thereby escaping the expression sandbox entirely. For crafted-context injection, the attacker may poison the context object with properties whose getters execute code during the library's internal property traversal. Exact payload syntax depends on the library version's internal structure, which is not specified in the NVD description; the attack surface is real, but payload construction would require version-specific reverse engineering.

Step 4 — Post-exploitation impact. Successful arbitrary code execution yields full control over the JavaScript runtime context:

• Server-side (Node.js): File-system read/write, process environment variable theft (secrets, API keys), outbound network connections for data exfiltration or command-and-control (C2), spawning of child processes for OS-level command execution.
• Client-side (browser/Electron): Session-token theft, DOM manipulation, keylogging, data exfiltration to attacker-controlled domains, and in Electron contexts, potential escalation to native OS-level access.

The exploitation is unauthenticated only if the vulnerable evaluation endpoint itself is unauthenticated; otherwise, it requires an account with access to the expression/context-input feature. No public PoC or exploit code exists per the CVE data; the attack chain above is representative of the code-injection class and is provided for SOC preparedness rather than as a tested proof-of-concept.

Impact Assessment

CVE-2025-12735 presents a critical risk profile despite missing CVSS metrics and EPSS standing at 0.02252 (81.8th percentile of exploited CVEs — meaning the model anticipates low-to-moderate immediately observed exploitation, but the CVE itself is included in the tail of scenarios historically associated with eventual exploitation). The absence of a CISA KEV listing and public PoCs suggests no confirmed in-the-wild exploitation as of this writing; however, exploit development for well-understood JavaScript sandbox escapes is typically rapid once researchers dissect a vulnerable version.

Business impact dimensions:

• Confidentiality: Full compromise of application secrets, user PII, and backend data accessible from the vulnerable runtime.
• Integrity: Arbitrary code execution permits data modification, account takeover, and backdoor installation.
• Availability: Crash, denial-of-service via resource-exhaustive payloads, or ransomware-style destruction.
• Compliance: If the vulnerable application processes regulated data (PCI-DSS, HIPAA, GDPR), exploitation may trigger mandatory breach-disclosure obligations.

Affected systems / blast radius: Any deployment incorporating expr-eval. Because the library is explicitly marketed as a "safe" evaluator, it is likely embedded in security-sensitive components (formulas in financial apps, policy engines, validation logic). Compromise of such a component may cascade into the surrounding microservice mesh or the client-side application state.

CVSS commentary: NVD reports CVSS Score/A vector as N/A — likely indicating that the CNA has not completed vector scoring at publication time. Analysts should treat this as a critical-severity placeholder until the vendor publishes scored metrics; the code-injection class in a library whose entire purpose is safe evaluation warrants emergency patching priority regardless of the numeric score.

Detection Guidance

Sigma Rule

This Sigma rule detects unexpected invocation of Node.js child_process or vm modules, which are common post-exploitation primitives following expr-eval sandbox escape. It targets Linux host telemetry.

title: Node.js Code Injection via Expression Evaluator - Child Process Execution
id: 7f81c2b4-3a9e-4f1d-9c20-d5e8f3b21f90
status: experimental
description: Detects child_process or vm module loading followed by execution, indicative of JavaScript code injection post-exploitation on Node.js applications (e.g., expr-eval CVE-2025-12735).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12735
author: Valters IT Security
date: 2025/04/15
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/node'
            - '/nodejs'
        CommandLine|contains|all:
            - 'child_process'
            - 'exec'
    condition: selection
falsepositives:
    - Legitimate server-side JavaScript that intentionally spawns processes (rare in expression-evaluator context)
level: high
tags:
    - attack.t1203
    - attack.execution
    - cve.2025.12735

YARA Rule

This YARA rule hunts for known suspicious code-injection strings that commonly appear in the immediate post-exploitation payload of JavaScript sandbox escapes targeting expression evaluators. Note: The payload strings below are generic to JavaScript sandbox-escape patterns referenced in the NVD description context (crafted context / MEMBER abuse) — they are detection heuristics, not reproduced exploit code from this CVE.

rule js_expr_eval_sandbox_escape_payload
{
    meta:
        author = "Valters IT Security"
        description = "Detects JavaScript payload strings commonly used in expression-evaluator sandbox escapes and arbitrary code execution (e.g., CVE-2025-12735 class)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12735"
        date = "2025-04-15"
        cve = "CVE-2025-12735"
        severity = "high"
    strings:
        $s1 = "constructor.constructor" ascii wide
        $s2 = "__proto__" ascii wide
        $s3 = "Function(" ascii wide
        $s4 = "process" ascii wide
        $s5 = "require(" ascii wide
        $s6 = "child_process" ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and // PE
        (2 of ($s*) ) or
        (uint32(0) == 0x464C457F) and // ELF
        (2 of ($s*) ) and
        (#s1 > 0 or #s2 > 0)
}

Suricata IDS Rule

This Suricata rule detects HTTP requests whose JSON body contains a combination of expression-evaluator marker keywords (evaluate, expr) alongside JavaScript code-execution primitives (constructor, Function(, child_process). It targets server-side evaluation endpoints.

alert http any any -> $HOME_NET any (msg:"CVE-2025-12735 - JavaScript Expression Evaluator Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"evaluate"; nocase; distance:0; content:"constructor"; nocase; distance:0; content:"Function"; nocase; distance:0; classtype:attempted-admin; sid:202512735; rev:1; metadata:cve CVE-2025-12735;)

Elastic Detection

This EQL rule correlates process-level child-process spawning with Node.js parent processes that exhibit command-line arguments containing common expression-evaluator or code-injection signatures.

process where event.action == "exec" and
  process.parent.name == "node" and
  (
    process.args : ("*constructor*", "*__proto__*", "*child_process*") or
    process.parent.args : ("*evaluate*", "*expr-eval*")
  )

Splunk SPL Query

This query searches endpoint logs for Node.js processes that invoked child processes shortly after receiving input containing JavaScript sandbox-escape markers; detect the sequence of node parent spawning sh/bash/node children with anomalous frequency.

index=* sourcetype=WinEventLog:Security OR sourcetype=linux_secure
| where (Image="*\\node.exe" OR Image="*/usr/bin/node" OR Image="*/usr/local/bin/node")
| join type=inner parent_process_id [
    search index=* (CommandLine="*constructor*" OR CommandLine="*__proto__*" OR CommandLine="*Function(*")
    | table ProcessId CommandLine
]
| table _time, host, Image, CommandLine, ParentImage, ParentProcessId
| eval threat=bif "possible expr-eval code injection (CVE-2025-12735)" if(like(CommandLine,"%child_process%"),"high","medium")

Wazuh OSSEC Rule

This Wazuh rule detects Node.js processes whose command line contains both expression-evaluation entry strings and code-execution payload markers — a behavior consistent with CVE-2025-12735 exploitation.

<group name="javascript,rce,">
  <rule id="127351" level="14">
    <decoded_as>json</decoded_as>
    <field name="command">\.node|nodejs\.exe</field>
    <regex>constructor|Function\(|__proto__</regex>
    <regex>child_process|spawn|exec</regex>
    <description>Possible CVE-2025-12735 - JavaScript expression evaluator code injection detected in Node.js process execution.</description>
    <group>attack_execution,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). The CNA asserts that a patch exists, but this is not independently confirmed; no vendor fix version is stated in the CVE record, and the affected-versions array is empty. Treat the vulnerability as unpatched until proven otherwise.

1) Immediate mitigations (while patch status is unconfirmed):

• Egress filtering: Restrict outbound network access from Node.js application servers to prevent data exfiltration post-exploitation.
• Runtime least-privilege: Run Node.js processes under a dedicated non-root service account with no filesystem write access beyond required directories and no capabilities to bind privileged ports.
• Input allow-listing: If expr-eval input originates from users, constrain input to strict allow-lists (e.g., only-digit-and-operator pattern matching) and reject any expression containing object-access keywords such as constructor, __proto__, prototype, or Function characters.
• Context object sanitization: Never pass attacker-influenced JSON objects as the evaluate() context. Freeze the context object (Object.freeze()) and sanitize keys against prototype-pollution patterns.
• Deploy Web Application Firewall (WAF) rules matching the Suricata/Sigma patterns above to block obvious exploit payloads at the perimeter.
• Application inventory: Identify all deployments bundling expr-eval; grep source maps and package-lock files for the dependency name.

2) Patch / upgrade steps:

• Monitor the official expr-eval GitHub repository (vendor: silentmatt/expr-eval) and the npm registry for a patched release. The CNA claims a fix exists — once a version is announced, upgrade immediately using npm update expr-eval or equivalent.
• Until a confirmed patched version is released, replace expr-eval with a maintained alternative (e.g., mathjs restricted to safe mode, jsep, or acorn-based parsers with explicit no-Function-constructor policies) or sandbox the evaluation inside a node:vm context with sandbox arguments stripped of all global references.
• As a stopgap, wrap the evaluate() call in a try/catch that inspects the expression string pre-execution for blacklisted tokens.

3) Long-term hardening:

• Re-audit all uses of expression-evaluation libraries; ensure "safe evaluation" claims are validated by the security team with adversarial testing (fuzzing, prototype-pollution checks).
• Enforce code-review policy that any library accepting user-controlled strings for interpretation must undergo security review before production deployment.
• Subscribe to CVE feeds and GitHub security advisories for expr-eval; re-evaluate on any release.
• Add runtime application self-protection (RASP) or eBPF-based syscall monitoring to alert on unexpected execve/spawn syscalls from Node.js processes.

Long-term note: Because no patch is confirmed, the only guaranteed mitigation is to stop passing untrusted input to expr-eval entirely.

References

1. NVD Entry — CVE-2025-12735: https://nvd.nist.gov/vuln/detail/CVE-2025-12735 — Primary authoritative source; NVD description and CWE classification (CWE-94) used throughout this report.
2. Expr-eval Official Repository (vendor): https://github.com/silentmatt/expr-eval — Upstream source for monitoring patched releases; npm package page: https://www.npmjs.com/package/expr-eval
3. CWE-94 — Code Injection (MITRE): https://cwe.mitre.org/data/definitions/94.html — Reference for vulnerable-class mechanics.
4. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2025-12735 is not currently listed; monitor for updates.
5. EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ — EPSS score 0.02252 (81.8th percentile); consult for active-exploitation probability modeling.

Threat-actor / in-the-wild evidence: No known threat-actor campaigns, exploit kits, or in-the-wild exploitation evidence was identified in the CVE data as of the report date. The EPSS percentile signals that large-scale exploitation has not yet materialized, but the vulnerability class (JavaScript sandbox escape) is a historically weaponized pattern. Security teams should treat appearance of exploit code on public forums as an immediate trigger for emergency incident response.