The expr-eval package contains a critical vulnerability (CVE-2026-12866) affecting all versions. The toJSFunction() API compiles user-supplied expressions into executable JavaScript using new Function(), which allows attackers to inject and execute arbitrary code. This occurs because the expressions are transformed directly into native code without sufficient sandboxing or validation, leading to code execution within the application context. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). No official patch or remediation is currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript code within the context of the vulnerable application. This can lead to full compromise of the application environment, data theft, or further attacks depending on the application's privileges and environment. The vulnerability is remotely exploitable without user interaction and requires no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using the toJSFunction() API with untrusted input. Consider applying input validation or sandboxing measures externally to restrict expression content. Monitor vendor channels for updates and patches.