CVE-2025-12735

CVE-2025-12735 is a critical arbitrary code execution vulnerability affecting the expr-eval JavaScript library, specifically jorenbroekema and silentmatt versions. An attacker can exploit insufficient input validation by crafting a malicious context object or using the MEMBER of the context object within the evaluate() function. This flaw carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation (KEV) or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media attention, indicating a high potential for future exploitation.