CVE-2026-12866: All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.
Metrics
- CVSS v4.0
- 9.2
- Severity
- CRITICAL
- Fixed in
- *
- Affected Products
- 1
HarborGuard Analysis
Synopsis
This is a code execution vulnerability in all published versions of the expr-eval npm package. An unauthenticated attacker who can supply input to the toJSFunction() API can craft an expression that escapes the expression sandbox and executes arbitrary JavaScript inside the application process, because the library compiles user-supplied expressions using the native Function() constructor without sufficient restriction. Successful exploitation gives the attacker full code execution within the application's runtime context, enabling data theft, data tampering, and denial of service. No fix version exists upstream; HarborGuard tracks this advisory and will make a patched rebuild available the moment one is published.
HarborGuard Coverage
Detection of CVE-2026-12866 is available across every HarborGuard environment: the CVE is ingested from upstream feeds within minutes of publication and matched against all customer images, including custom-built images that bundle expr-eval as a direct or transitive dependency, regardless of how the package was introduced.
AvailableTriage is available with the full CVSS v4.0 score of 9.2 (Critical) applied automatically to each matched finding; per-environment compliance policy weighting is then applied to adjust priority, and the resulting alert is routed to the inbox configured for the owning team inside each customer organization.
AvailableBecause no upstream fix version exists for expr-eval at this time, HarborGuard re-checks the advisory on every ingest cycle and will make a patched-image rebuild available automatically the moment the upstream maintainer ships a remediated release. For customers who opt into auto-remediation, the rebuild, regression-test run, and PR against affected workloads will be triggered without manual intervention.
AvailableExploit Conditions
- Network reachabilityRequired
The attacker must reach the vulnerable service over the network; the CVSS vector specifies AV:N, meaning the toJSFunction() call must be exposed to network-reachable input.
- AuthenticationNot required
No authentication is needed; PR:N means any unauthenticated party who can send input to the API is sufficient to trigger the vulnerability.
- Victim interactionNot required
No victim interaction is required; UI:N means the attacker does not need to socially engineer any user to complete the attack.
- Attack complexityDetail
The base exploit is condition-free (AC:L), though AT:P indicates the attack depends on a prerequisite deployment condition, such as user-controlled input reaching toJSFunction() without an intervening sanitization layer.
Blast Radius
- Reads secrets, environment variables, and in-process session tokens available to the Node.js runtime.
- Writes or deletes files and data accessible to the application process user.
- Executes operating-system commands, enabling lateral movement to other services reachable from the container.
- Crashes the application process or exhausts its resources, causing a denial of service for dependent workloads.
How HarborGuard Handles This
Available on HarborGuard: because no upstream fix for expr-eval exists today, HarborGuard continuously monitors the advisory and re-evaluates it on every ingest cycle. In the interim, compensating controls are worth considering: network-policy isolation to restrict which services can submit expressions to the affected endpoint, egress filtering to limit what a compromised container can reach, and feature-flag gating to disable the toJSFunction() code path if it is not essential to production operation. For customers who opt into auto-remediation, a patched-image rebuild, regression-test run, and PR against affected workloads will be initiated automatically the moment an upstream fix is published, with no manual intervention required. The critical CVSS v4.0 score of 9.2 means this advisory is surfaced at the top of the compliance queue in every HarborGuard environment where a matching image is detected.
Fix available
- n/a / expr-eval< * (from 0)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N