Loading story…
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-12735, has been discovered in the widely used JavaScript library expr-eval and its actively maintained fork, expr-eval-fork. The flaw, identified by security researcher Jangwoo Choe, arises from insufficient validation of variables or context objects passed to the Parser.evaluate() function, allowing attackers to inject malicious function objects and gain total control over affected systems. The vulnerability impacts both the original library and its fork, which together account for hundreds of thousands of weekly downloads and are used in a variety of applications, including online calculators, educational tools, financial software, and AI/NLP systems.
CERT Coordination Center (CERT/CC) and CISA have rated the issue as critical, with a CVSS score of 9.8, warning that exploitation could lead to full system compromise or disclosure of all information on the affected system. Users are strongly advised to upgrade to expr-eval-fork version 3.0.0, which addresses the vulnerability by implementing a safe function allowlist, a custom function registration system, and improved test coverage. The security fix is essential for all projects relying on either the original or forked versions of expr-eval to prevent exploitation in production environments.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A remote code execution flaw affecting the popular expr-eval JavaScript library was publicly disclosed. Multiple outlets reported the issue as enabling possible RCE in applications using the library.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability, tracked as CVE-2025-61927, has been discovered in the Happy DOM JavaScript library, which is widely used for server-side rendering and testing frameworks. The flaw allows attackers to escape the virtual machine (VM) context, potentially leading to remote code execution on affected systems. Happy DOM, with over 2.7 million weekly downloads, is integrated into numerous applications, amplifying the potential impact of this vulnerability. The root cause of the issue lies in improper isolation of the Node.js VM context in Happy DOM versions 19 and earlier, which fails to adequately sandbox untrusted code. Security researcher Mas0nShi identified that attackers can exploit the JavaScript constructor inheritance chain to access the global Function constructor, enabling arbitrary code execution. In environments using the CommonJS module system, attackers can further leverage the require() function to import and execute additional modules, broadening the attack surface. While ECMAScript module (ESM) environments restrict some capabilities, they are still affected by the core VM context escape. The vulnerability has been assigned a CVSS score of 9.4, underscoring its severity and the urgency for remediation. Millions of applications that rely on Happy DOM for testing or server-side rendering are at risk if they have not updated to a patched version. The flaw enables attackers to bypass intended security boundaries, potentially compromising the host system and any sensitive data processed within the affected environment. Security advisories recommend immediate updates to the latest version of Happy DOM to mitigate the risk. Organizations are urged to review their software supply chain for dependencies on Happy DOM and to apply patches as soon as possible. The vulnerability highlights the risks associated with improper sandboxing in JavaScript environments, especially in widely adopted open-source libraries. No reports of active exploitation have been confirmed at this time, but the public disclosure and technical details increase the likelihood of exploitation attempts. Security teams should monitor for suspicious activity related to Node.js processes and review application logs for signs of compromise. The incident serves as a reminder of the importance of rigorous security testing and isolation in libraries that execute untrusted code. Developers and DevOps teams should prioritize dependency management and vulnerability scanning to reduce exposure to similar flaws in the future.
Jun 29, 2026
Elastic Cloud Enterprise (ECE) was found to contain a critical remote code execution (RCE) vulnerability, identified as CVE-2025-37729, which carries a CVSS score of 9.1, indicating its high severity. The flaw arises from improper neutralization of special elements in the Jinjava template engine, a component used within ECE’s configuration templates. Attackers with administrative access can exploit this vulnerability by submitting specially crafted strings that are evaluated by Jinjava, allowing them to execute arbitrary commands on the server. This could lead to exfiltration of sensitive information and full compromise of affected ECE deployments. The vulnerability specifically impacts ECE versions 2.5.0 up to and including 3.8.1, and versions 4.0.0 up to and including 4.0.1. Exploitation requires access to the ECE admin console and interaction with deployments configured with the Logging+Metrics feature enabled. By leveraging this flaw, a malicious actor can inject code through deployment plans and retrieve the results via ingested logs, effectively achieving server-side code execution. Elastic has responded by releasing patched versions 3.8.2 and 4.0.2, which address the issue by hardening the Jinjava variable evaluation process. The vulnerability was publicly disclosed in mid-October 2025, and security advisories urge all affected organizations to update their ECE installations immediately. The flaw is considered remotely exploitable, but only by users with administrative privileges, which somewhat limits the attack surface but does not diminish the potential impact. No evidence of exploitation in the wild has been reported at the time of disclosure, but the critical nature of the vulnerability has prompted urgent action from Elastic and the security community. The vulnerability was reported by a member of the Elastic security team, and details were published in both vendor advisories and CVE databases. Organizations using Elastic Cloud Enterprise are advised to review their access controls and ensure that only trusted personnel have administrative access. The incident highlights the risks associated with template injection vulnerabilities in cloud management platforms. Security teams are encouraged to monitor for any suspicious activity in ECE admin consoles and to apply the recommended patches without delay. The disclosure has also prompted discussions about the importance of input sanitization in template engines used in enterprise software. Elastic’s swift response and detailed advisories have been commended by the cybersecurity community. The vulnerability underscores the need for regular security reviews and prompt patch management in cloud environments.
Jun 29, 2026
Belgium’s Centre for Cybersecurity has warned of a **critical remote code execution** flaw in the LiquidJS template engine, and public reporting identifies the issue as `CVE-2026-45618` with a **CVSS score of 10.0**. The vulnerability affects LiquidJS versions **10.25.7 and earlier** and stems from improper input validation during filter evaluation, which can let an attacker reach the internal execution context, manipulate internal functions, and obtain access to the JavaScript `Function` constructor. Successful exploitation could allow arbitrary command execution and access to sensitive files, creating a path to full system compromise in applications that process untrusted templates. LiquidJS is widely used to bring Shopify, Jekyll, and GitHub Pages-style templating to Node.js environments and is reported to have more than **7.3 million monthly downloads**, expanding the downstream exposure. Maintainers have addressed the flaw in **LiquidJS 10.27.0**, and defenders are being urged to inventory affected systems and upgrade immediately.
Jun 29, 2026