What is CVE-2026-12866?

CVE-2026-12866 is a critical-severity vulnerability in Expr-eval, classified under Code Injection. CVSS score: 9.8/10. Published 2026-06-23.

How severe is CVE-2026-12866?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Expr-eval

CVE-2026-12866

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Becau…

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a Expr-eval — versions 0

Weakness classification (CWE)

CWE-94 — Code Injection

References

report@snyk.io
report@snyk.io
report@snyk.io

Frequently asked questions

What is CVE-2026-12866?: CVE-2026-12866 is a critical-severity vulnerability in Expr-eval, classified under Code Injection. CVSS score: 9.8/10. Published 2026-06-23.
How severe is CVE-2026-12866?: Critical severity. CVSS v3 base score is 9.8 out of 10.