CVE-2025-12735

This repository provides a secure drop-in replacement for the vulnerable `expr-eval` library (CVE-2025-12735), which was susceptible to arbitrary code execution via JavaScript's `eval()` function. The `safe-expr-eval` library implements a secure expression evaluator using tokenization, parsing, and AST evaluation without dynamic code execution.

This repository contains a Python-based exploit for CVE-2025-12735, targeting the `expr-eval` and `expr-eval-fork` npm packages. The exploit demonstrates RCE by manipulating the context object to inject arbitrary functions, with features for detection, endpoint discovery, and command execution.

This repository contains a Python-based exploit for CVE-2025-12735, targeting the `expr-eval` and `expr-eval-fork` npm packages. The exploit demonstrates RCE by injecting arbitrary functions into the context object used by the parser.