An incredibly popular JavaScript library might have some worrying malware issues

JavaScript code on a computer screen.

• CVE-2025-12735 in expr-eval allows remote code execution via unsafe input evaluation
• Vulnerable versions ≤2.0.2; patched in 2.0.3 and forked in expr-eval-fork 3.0.0
• Developers should sanitize variables and avoid untrusted input in evaluate() calls

A widely-adopted JavaScript library has been found carrying a critical vulnerability which could allow threat actors to execute malicious code, remotely.