CVE-2026-12866 affects all versions of the expr-eval package. The vulnerability arises because the toJSFunction() API compiles user-supplied expressions into native JavaScript code using new Function(). Since these expressions are directly transformed into executable code without sufficient sandboxing, attackers can escape the intended expression sandbox and execute arbitrary JavaScript code. This leads to remote code execution in the context of the vulnerable application. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript code remotely within the context of the vulnerable application. This can lead to full compromise of the application environment, including data theft, manipulation, or denial of service. The vulnerability is critical due to its ease of exploitation and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using the toJSFunction() API with untrusted input or implement strict input validation and sandboxing measures to prevent execution of malicious expressions.