CVE-2025-13204

Executive Summary

CVE-2025-13204 is a Prototype Pollution vulnerability (CWE-1321) identified in the npm package expr-eval, a JavaScript library used for parsing and evaluating mathematical and logical expressions. An attacker with access to an interface that processes user-supplied expressions through expr-eval can leverage JavaScript's prototype-based inheritance model to pollute the Object.prototype, potentially achieving arbitrary code execution on the affected application's runtime environment. The vulnerability has been remediated in the expr-eval-fork package, with a patch confidence rating of 3/4 (LIKELY) based on confirmation from two independent sources (CNA and RHSA). Organizations using expr-eval to evaluate untrusted input should identify affected deployments and prioritize upgrading to the patched fork. The CVSS score is N/A, and there is no CISA KEV listing, no public PoC, and no known exploitation in the wild at the time of this report; however, the vulnerability class is high-risk due to its potential to lead to remote code execution. EPSS score is 0.00452 (37.8% percentile), indicating low current exploitation probability.

Technical Analysis

Prototype Pollution is a class of vulnerability (CWE-1321) arising from JavaScript's prototype-based inheritance model. In this model, objects inherit properties and methods from their prototype chain, culminating in the global Object.prototype. When an application recursively merges, copies, sets, or assigns properties from attacker-supplied input — typically via functions such as merge, clone, deep-extend, or through unsafe property assignment in an evaluation context — an attacker can inject properties like __proto__, constructor.prototype, or prototype into the root prototype of all JavaScript objects.

In the context of expr-eval, the vulnerable mechanism is the evaluation of expressions against the object model. An attacker who controls the expression string being evaluated can craft an expression that references or modifies the prototype chain during the runtime execution of the expression parser. The NVD description states that "an attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution."

The attack surface is the "express eval interface" — that is, any web application endpoint or service integration where user-provided strings are passed directly into an expr-eval parser for evaluation. Common use cases for expr-eval include dynamic rule engines, custom calculator features, configurable dashboards, form validation logic, and business-rule editors where end-users or administrators supply expressions.

The underlying technical flaw is that the expression evaluator, while parsing and executing the supplied expression, does not sanitize or block prototype-related property accesses or assignments. By crafting expressions that traverse to __proto__ or constructor.prototype, the attacker can override default object behaviors — such as setting properties or function definitions (via the constructor's prototype) — resulting in modifications that propagate throughout the application's global object model. This can lead to bypassing security checks, escalating privileges, or — when combined with gadgets that read polluted properties — full arbitrary code execution.

Insufficient technical detail is available in the public advisory to specify the exact parser function names, the precise sanitization gaps, or the precise payload syntax. No affected version list is provided; the OSV record indicates / (0→unfixed) with the expr-eval-fork package confirmed as the fix.

Exploitation Scenarios

No public PoC is available for CVE-2025-13204; the following attack chain is inferred from the vulnerability class (Prototype Pollution) and the NVD description. It is presented at the class level without fabricating specific implementation details.

Step 1: Reconnaissance / Target Identification. The attacker identifies a public-facing web application or internal service that exposes an expression-evaluation interface. This can be discovered by inspecting client-side JavaScript bundles for references to well-known expression parser libraries (such as expr-eval), by observing URL parameters or API request bodies that accept formula-like strings, or by looking for features such as "custom rules," "calculated fields," "dynamic filters," or "expression builder" modules.

Step 2: Triggering the Flaw. The attacker crafts a specially malformed expression string designed to pollute the JavaScript prototype. The payload is submitted to the vulnerable interface as part of the expected expression input. Because the parser evaluates the string against the live object model without adequate isolation, the prototype-pollution payload is processed. The attack leverages JavaScript's __proto__ and constructor.prototype chain to inject or override properties on Object.prototype.

Step 3: Payload / Execution Method. The attacker's goal is to inject a property that will be consumed by an application code path that executes attacker-controlled content. For example, prototype pollution of a property later read as a function, callback handler, module name, or configuration value (a "gadget") can redirect execution flow. The NVD description asserts that Prototype Pollution in this package can lead to arbitrary code execution; this implies that within the parser or common application usage patterns, properties stored on the prototype are retrievable and executable in a manner that gives the attacker control over the code path.

Step 4: Post-Exploitation Impact. Successful arbitrary code execution leads to full server-side compromise, depending on the privileges of the application process — which is commonly a service account with access to application configuration, database credentials, and potentially the broader internal network. The attacker could install persistent backdoors, exfiltrate application data, pivot to connected infrastructure, or disrupt availability.

Impact Assessment

The exact CVSS score is N/A in the provided data; however, the vulnerability class of Prototype Pollution leading to arbitrary code execution typically warrants a critical severity rating, because the fundamental impact is Remote Code Execution (RCE) in the context of the application. The actual risk magnitude depends on whether any "gadget" — an existing code path vulnerable to the polluted property — is reachable in the consuming application, and whether the attacker-supplied expression input can reach the vulnerable evaluator without prior authentication or authorization.

Affected Systems: All deployments of the expr-eval npm package that pass attacker-influenced or untrusted user input into the expression parser. This includes applications with "custom expression," "dynamic rules," "advanced search," "formula builder," or "configuration editor" functionality.

Business Impact: Server-side compromise can lead to data breach, system takeover, lateral movement, service disruption, and — where the affected application manages sensitive business logic or financial calculations — integrity loss and regulatory consequences.

Blast Radius: Broad. The expr-eval library was historically widely used; the OSV data shows the vulnerable state from version 0 through unfixed in the mainline package, which suggests many prior releases are affected. Only the fork expr-eval-fork is confirmed patched.

Early Risk Indicators: CISA KEV is NO (not known to be exploited), EPSS is 0.00452 (37.8% percentile), and there is no observed exploit code or campaign activity at the time of this report. This suggests low immediate adversarial interest, but the window may close once exploit details become public.

Detection Guidance

Sigma Rule

title: Prototype Pollution Attempt via expr-eval Expression String
id: 4f6d44aa-5184-4a54-a7c1-3c1f8bb26f31
status: experimental
description: >-
  Detects web requests or application logs containing prototype-pollution payload
  strings targeting the expr-eval library via __proto__ or constructor.prototype.
  Based on vulnerability class CWE-1321 for CVE-2025-13204.
author: Valters IT Threat Intelligence
date: 2025-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_proto:
    all:
      - 'Body|contains: "__proto__"'
      - 'Body|contains: "constructor"'
  selection_proto_direct:
    Body|contains: 'constructor.prototype'
  selection_pollution_keys:
    Body|contains|all:
      - 'prototype'
      - '='
  condition: selection_proto_direct or (selection_proto and selection_pollution_keys)
fields:
  - client_ip
  - http.user_agent
  - url.original
falsepositives:
  - Legitimate security research.
  - Application features that legitimately process "__proto__" or prototype-related strings.
level: medium

YARA Rule

rule expr_eval_prototype_pollution_payload
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects payloads targeting prototype pollution in expr-eval (CVE-2025-13204)"
        reference = "NVD CVE-2025-13204"
        date = "2025-01-01"
        cve = "CVE-2025-13204"
        cwe = "CWE-1321"
    strings:
        $s1 = "__proto__" ascii wide
        $s2 = "constructor.prototype" ascii wide
        $s3 = "prototype" ascii wide
        $s4 = "expr-eval" ascii wide
        $s5 = "eval" ascii wide nocase
    condition:
        // prototype pollution keywords in expression language context
        (($s1 or $s2) and ($s3 or $s5)) or ($s4 and $s1)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2025-13204 - expr-eval Prototype Pollution Payload in HTTP Body";
    flow:to_server,established;
    content:"__proto__"; http_client_body;
    content:"constructor"; http_client_body; within:100;
    sid:202513204;
    rev:1;
    metadata:created_at 2025_01_01, updated_at 2025_01_01, cve CVE-2025-13204, cwe CWE-1321;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2025-13204;
    classtype:attempted-admin;
)

Elastic Detection

framework = "MITRE ATT&CK"
where process == "node"
    and event.category == "network"
    and event.direction == "ingress"
    and (
        url.body contains "__proto__"
        and url.body contains "constructor.prototype"
    )

Splunk SPL Query

index=web OR index=proxy OR index=main
  (url_path=* OR http_body!=None)
  [search http_body="__proto__" OR http_body="constructor.prototype"]
  OR ar_message_text="__proto__" OR ar_message_text="constructor.prototype"
| table _time, src_ip, dest_ip, dest_port, url, http_method, http_body, user
| eval polluted_indicator = if(match(http_body, "(?i)__proto__|constructor\.prototype"), "PROTOTYPE_POLLUTION_INDICATOR", "NORMAL")
| search polluted_indicator = "PROTOTYPE_POLLUTION_INDICATOR"
| rex field=http_body "max_match=10 (?<pollution_payloads>\S*__proto__\S*|\S*constructor\.prototype\S*)"
| stats count by src_ip, dest_ip, dest_port, url, pollution_payloads
| sort - count

Wazuh OSSEC Rule

<group name="web_application attacks,">
  <rule id="100204" level="12">
    <decoded_as>json</decoded_as>
    <match>__proto__|constructor\.prototype</match>
    <regex>(?i)__proto__|constructor\.prototype</regex>
    <field name="url">\.</field>
    <description>Potential Prototype Pollution attempt via expr-eval (CVE-2025-13204) detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploitation,</group>
  </rule>
</group>

Note: Wazuh rule syntax requires proper decoder matching to actual Apache/Nginx/JSON logs; the above rule should be field-aligned to your actual log source (e.g., url, http_request, message) in production.

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — two independent sources, CNA and RHSA, confirm the fix exists in the expr-eval-fork package).

1) Immediate Mitigations (No Public Workaround Confirmed): Because no workaround is provided, highest priority is disabling or restricting access to any expression-evaluation feature that accepts untrusted input until patching is complete. Options:

• Remove or disable the expr-eval-powered feature if it is non-essential.
• If the feature must remain operational, restrict access to authenticated and privileged users only, and review logic to confirm such users are trusted.
• Implement an allowlist of allowed expression characters and keywords for the expression input; reject expression strings containing the patterns __proto__, constructor, prototype and this.
• If the application can be modified, wrap the expression evaluation with a frozen object context: Object.freeze(Object.prototype) before calling the parser (this is a common stop-gap for Prototype Pollution, but verification against the package internals is required).

2) Patch / Upgrade Steps:

• Replace the expr-eval npm dependency with the patched fork: npm install expr-eval-fork --save.
• Update all import statements or require paths across codebase: const Parser = require('expr-eval-fork');.
• Validate application behavior post-upgrade by running unit and integration tests covering expression evaluation functionality.
• If direct dependency on expr-eval is transitive (i.e., used inside another package), use npm overrides or yarn resolutions to force the patched fork to which the npm ecosystem maps (verify compatibility by checking dependent package support).
• Consult the RHSA advisory (referenced in the patch sources) for any additional package-manager-specific guidance.

3) Long-Term Hardening:

References

1. NVD Entry — CVE-2025-13204: https://nvd.nist.gov/vuln/detail/CVE-2025-13204
2. expr-eval GitHub Repository (Project Status): https://github.com/silentmatt/expr-eval — where patch forks and relevant discussions are tracked.
3. Red Hat Security Advisory (RHSA) — patch confirmation source: (Access restricted to commercial subscribers; search "RHSA expr-eval" in the Red Hat Customer Portal.) — one of the two independent sources (CNA + RHSA) used for the 3/4 patch-confidence rating.
4. Microsoft OSV Package Advisory (OSV record for expr-eval): https://osv.dev/vulnerability/CVE-2025-13204 — tracks affected package state as / (0→unfixed) and notes expr-eval-fork as the fix.
5. MITRE ATT&CK — Exploit Public-Facing Application (T1190): https://attack.mitre.org/techniques/T1190/ — applicable technique for attacker entry in common remote exploitation scenarios.

Known Threat Campaigns / In-the-Wild Exploitation: No CISA KEV listing, no public PoC, and no actor-campaign evidence is available at the time of this report. EPSS 0.00452 (37.8% percentile) indicates low real-world exploitation probability. Security teams should monitor the GitHub repository and Red Hat advisory streams for release of proof-of-concept code, as Prototype Pollution payload patterns (proto/constructor.prototype) are widely documented and weaponize quickly once a library is confirmed exploitable.