The vulnerability lies in the expr-eval library’s toJSFunction API, which converts user‑supplied expression strings into native JavaScript code via new Function. Because the conversion occurs without sanitisation, an attacker can supply a crafted expression that turns into executable JavaScript, escaping the intended sandbox. The result is arbitrary code execution within the process that loads the library, as defined by the CWE‑94 classification.

All released versions of expr‑eval, a JavaScript expression evaluator library commonly used in web and Node.js applications, are affected. Any project that imports the npm package expr‑eval and exposes the toJSFunction interface to untrusted input, regardless of vendor, is vulnerable. The issue is present across all major releases up to and including the latest published version at the time of disclosure.

The CVSS score of 9.2 categorises the flaw as critical, signalling that exploitation would grant full control over the target environment. The EPSS score is not available, so the current exploitation probability cannot be quantified, yet the absence of a KEV listing does not reduce the urgency, because the flaw permits direct execution. Attackers would most likely target applications that evaluate expressions from external sources, such as user‑configurable scripts or validation rules; the code path is reachable as soon as toJSFunction is called with crafted input.