{"schemaVersion":3,"id":"CVE-2025-13204","aliases":["RHSA-2026:0140","GHSA-8gw3-rxh4-v6jx","CGA-427f-vvm6-3mmj","CGA-4hc8-vmm4-m285","CGA-5x8g-f3j5-c697","CGA-628p-77q3-jp26","CGA-6m9w-7957-rx3x","CGA-7gr8-7wqv-fchg","CGA-8r44-4qh6-pcx5","CGA-9332-4gvq-pfx2","CGA-95fq-hcqw-c4rf","CGA-98qr-fgh9-p4g5","CGA-9cr7-mv96-qp69","CGA-ch7f-3c2j-5qw8","CGA-cxpf-7x5g-vg2q","CGA-fjw7-chgx-mhrw","CGA-fmq8-fgx8-p9qq","CGA-fvvp-3c2f-fv52","CGA-gp9p-hp2m-m4xw","CGA-hcj8-773p-xghh","CGA-hxpg-xfxj-h646","CGA-j6x3-w3rm-g8vc","CGA-j73g-93jw-qm7q","CGA-m57h-chwq-q5hq","CGA-mmq2-9p5g-v8j8","CGA-mwp4-w6cp-fgrq","CGA-pq4f-xm3c-5rhh","CGA-qp28-qw8r-fq9w","CGA-rwwg-rjfv-vc73","CGA-x598-57j7-4536","CGA-x5g7-77mf-c5vv","CGA-x7mr-76q3-ff8p","CGA-xm6h-8hx9-p3jv","CGA-xp48-24vm-7p8w"],"status":"published","duplicateOf":null,"title":null,"description":"npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.","dates":{"published":"2025-11-14T17:02:39.529Z","modified":"2025-11-14T20:41:22.990Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.3,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":10,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":10,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":10,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00484,"percentile":0.40406,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.032,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00452},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00484,"percentile":0.40406}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00452,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00484,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00484,"percentile":0.40406}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_VLADKO312_EXTRAS","name":"Extras","source":"github","url":"https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_8359AF6E3AA45266","name":"Exploit Reference (huntr.dev)","source":"reference","url":"https://www.huntr.dev/bounties/1-npm-expr-eval/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","description":"The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1321.html"}],"affected":[{"vendor":"chainguard","product":"kibana-8.17","name":"kibana-8.17","label":"kibana-8.17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-bitnami","name":"kibana-8.17-bitnami","label":"kibana-8.17-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-bitnami","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-iamguarded","name":"kibana-8.17-iamguarded","label":"kibana-8.17-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18","name":"kibana-8.18","label":"kibana-8.18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18-bitnami","name":"kibana-8.18-bitnami","label":"kibana-8.18-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18-bitnami","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18-iamguarded","name":"kibana-8.18-iamguarded","label":"kibana-8.18-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r32","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r32","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r32","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.1-r0","eol":null,"hubHref":null},{"vendor":"Npm","product":"expr-eval","name":"expr-eval","label":"expr-eval","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/expr-eval","purlType":"npm","versions":[{"text":"≤ 2.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.0.2","eol":null,"hubHref":null},{"vendor":"Npm","product":"expr-eval-fork","name":"expr-eval-fork","label":"expr-eval-fork","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/expr-eval-fork","purlType":"npm","versions":[{"text":"< 2.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-pcp","name":"grafana-pcp","label":"grafana-pcp","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-pcp","purlType":"rpm","versions":[{"text":"< 0:1.0.5-5.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:1.0.5-5.el8_2","eol":null,"hubHref":null},{"vendor":"silentmatt","product":"expr-eval","name":"expr-eval","label":"expr-eval","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.0.2","eol":null,"hubHref":"/vendor/silentmatt/expr-eval"}],"affectedCount":20,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.npmjs.com/package/expr-eval-fork","label":"www.npmjs.com/package/expr-eval-fork","hostname":"www.npmjs.com","tags":["ARTICLE","WEB","Product"]},{"url":"https://github.com/silentmatt/expr-eval","label":"github.com/silentmatt/expr-eval","hostname":"github.com","tags":["ARTICLE","PACKAGE","Product"]},{"url":"https://github.com/jorenbroekema/expr-eval","label":"github.com/jorenbroekema/expr-eval","hostname":"github.com","tags":["ARTICLE","WEB","PACKAGE","Product"]},{"url":"https://www.huntr.dev/bounties/1-npm-expr-eval/","label":"www.huntr.dev/bounties/1-npm-expr-eval/","hostname":"www.huntr.dev","tags":["Third Party Advisory","Advisory","Exploit"]},{"url":"https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py","label":"github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py","hostname":"github.com","tags":["WEB","Product"]},{"url":"https://github.com/silentmatt/expr-eval/pull/252/files","label":"github.com/silentmatt/expr-eval/pull/252/files","hostname":"github.com","tags":["Patch","WEB","FIX","Issue Tracking"]},{"url":"https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py","label":"github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py","hostname":"github.com","tags":["Exploit","WEB","EVIDENCE","Product"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0140","label":"access.redhat.com/errata/RHSA-2026:0140","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2415051","label":"bugzilla.redhat.com/show_bug.cgi?id=2415051","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0140.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0140.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13204","label":"access.redhat.com/security/cve/CVE-2025-13204","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13204","label":"www.cve.org/CVERecord?id=CVE-2025-13204","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13204","label":"nvd.nist.gov/vuln/detail/CVE-2025-13204","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/jorenbroekema/expr-eval/commit/6c475a118643ae0efe012de283e932fb8b74324b","label":"github.com/jorenbroekema/expr-eval/commit/6c475a118643ae0efe012de283e932fb8b74324b","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/silentmatt/expr-eval/commit/6e889e0e75c50ac37d70c35388602025650e0c50","label":"github.com/silentmatt/expr-eval/commit/6e889e0e75c50ac37d70c35388602025650e0c50","hostname":"github.com","tags":["WEB"]},{"url":"https://www.huntr.dev/bounties/1-npm-expr-eval","label":"www.huntr.dev/bounties/1-npm-expr-eval","hostname":"www.huntr.dev","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13204.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13204.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-94M4-XRMP-9H6F"]},"timeline":[{"kind":"published","date":"2025-11-14T17:02:39.529Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-11-14T20:41:22.990Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":39,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:40:20.812Z","stale":false,"partial":false}}