The npm package expr-eval is affected by a Prototype Pollution vulnerability (CVE-2025-13204) that allows an attacker to manipulate JavaScript prototype inheritance via the expression evaluation interface. This flaw can lead to arbitrary code execution. The vulnerability is fixed in version 2.0.2 of expr-eval. Users should upgrade to this version or later to mitigate the risk.