{"id":"CVE-2025-13204","state":"PUBLISHED","title":"CVE-2025-13204","description":"npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.","publishedAt":"2025-11-14T17:02:39.529Z","updatedAt":"2026-10-30T18:06:36.383Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"certcc","products":["silentmatt expr-eval"],"affected":[{"vendor":"silentmatt","product":"expr-eval","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.2","versionType":"custom"}]}],"references":["https://www.npmjs.com/package/expr-eval-fork","https://github.com/silentmatt/expr-eval","https://github.com/jorenbroekema/expr-eval","https://www.huntr.dev/bounties/1-npm-expr-eval/","https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py","https://github.com/silentmatt/expr-eval/pull/252/files","https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py"],"weaknesses":["CWE-1321"],"ingestedAt":"2026-10-30T18:20:07.061Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/13xxx/CVE-2025-13204.json","commit":"55f8edbf9d47efa62275e8ca91bb2e15e821b559","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-13204","state":"PUBLISHED","datePublished":"2025-11-14T17:02:39.529Z","dateUpdated":"2026-10-30T18:06:36.383Z","assignerShortName":"certcc","assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateReserved":"2025-11-14T16:52:35.957Z"},"containers":{"cna":{"title":"CVE-2025-13204","descriptions":[{"lang":"en","value":"npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue."}],"affected":[{"vendor":"silentmatt","product":"expr-eval","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.2","versionType":"custom"}]}],"references":[{"url":"https://www.npmjs.com/package/expr-eval-fork"},{"url":"https://github.com/silentmatt/expr-eval"},{"url":"https://github.com/jorenbroekema/expr-eval"},{"url":"https://www.huntr.dev/bounties/1-npm-expr-eval/","tags":["third-party-advisory"]},{"url":"https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py"},{"url":"https://github.com/silentmatt/expr-eval/pull/252/files","tags":["patch"]},{"url":"https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvcV2_0_0","content":{"timestamp":"2025-11-07T15:47:01.238Z","schemaVersion":"2.0.0","selections":[{"values":[{"key":"P","name":"Public PoC"}],"name":"Exploitation","version":"1.1.0","namespace":"ssvc","definition":"The present state of exploitation of the vulnerability.","key":"E"},{"values":[{"key":"Y","name":"Yes"}],"name":"Automatable","version":"2.0.0","namespace":"ssvc","definition":"Can an attacker reliably automate creating exploitation events for this vulnerability?","key":"A"},{"values":[{"key":"T","name":"Total"}],"name":"Technical Impact","version":"1.0.0","namespace":"ssvc","definition":"The technical impact of the vulnerability.","key":"TI"}]}}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}],"providerMetadata":{"shortName":"certcc","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateUpdated":"2025-11-14T20:20:20.104Z"},"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"VINCE 3.0.28","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2025-13204"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T18:06:32.275092Z","id":"CVE-2025-13204","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1321","type":"CWE","lang":"en","description":"CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-30T18:06:36.383Z"}}]}}}