CVE-2025-13204

CVE-2025-13204 describes a Prototype Pollution vulnerability in the npm package expr-eval, specifically affecting silentmatt javascript_expression_evaluator. An attacker with access to the express eval interface could leverage this flaw to achieve arbitrary code execution. This vulnerability carries a CVSS score of 7.3 (HIGH), indicating a network-based attack with low attack complexity and potential for low impact on confidentiality, integrity, and availability. The npm expr-eval-fork package resolves this issue. Currently, there is no evidence of active exploitation, nor are there known Metasploit, Nuclei, or ExploitDB modules. Community discussion and media coverage are minimal, suggesting low public awareness of this vulnerability.