CVE-2025-13204: expr-eval: expr-eval: Prototype Pollution

Severity: Critical

CVSS Score: 7.3

npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.