The vulnerability lies in the expr‑eval library’s toJSFunction API, which converts user‑supplied expression strings into native JavaScript code via new Function. Because the conversion occurs without sanitisation, an attacker can supply a crafted expression that turns into executable JavaScript, escaping the intended sandbox. The result is arbitrary code execution within the process that loads the library, as defined by the CWE‑94 and CWE‑917 classifications.

All released versions of expr‑eval, a JavaScript expression evaluator library commonly used in web and Node.js applications, are affected. Any project that imports the npm package expr‑eval and exposes the toJSFunction interface to untrusted input, regardless of vendor, is vulnerable. The issue is present across all major releases up to and including the latest published version at the time of disclosure.

The CVSS score of 9.2 categorises the flaw as critical, signalling that exploitation would grant full control over the target environment. The EPSS score of 0.00454 indicates a very low exploitation probability. The absence of a KEV listing does not reduce the urgency, because the flaw permits direct execution. Attackers would most likely target applications that evaluate expressions from external sources, such as user‑configurable scripts or validation rules; the code path is reachable as soon as toJSFunction is called with crafted input.