TITLU: Vulnerabilitatea CVE-2026-12866 - Detalii CVSS, EPSS și CISA Kev | CVE Find

SUMAR:

Vulnerabilitatea CVE-2026-12866 afectează toate versiunile pachetului expr-eval. Dacă un atacator oferă expresii craftate care sunt compilate în cod nativ folosind new Function(), poate executa JavaScript arbitrar. Expresiile controlate de utilizator sunt transformate direct în JavaScript executabil, ceea ce permite atacatorilor să escapa din sandboxul expus și să ruleze cod arbitrar în contextul aplicatii.

DESCRIPȚIE TECNICA PENTRU DEFENSORI:

Vulnerabilitatea CVE-2026-12866 afectează toate versiunile pachetului expr-eval. Dacă un atacator oferă expresii craftate care sunt compilate în cod nativ folosind new Function(), poate executa JavaScript arbitrar. Expresiile controlate de utilizator sunt transformate direct în JavaScript executabil, ceea ce permite atacatorilor să escapa din sandboxul expus și să ruleze cod arbitrar în contextul aplicatii.

CODUL EDUCATIV SECURITAR

// Exemplu de cod de vulnerabilitate (s─â nu fie rulat)
function executeExploit(expression) {
    try {
        const result = new Function('return ' + expression)();
        console.log(result);
    } catch (error) {
        console.error(error);
    }
}

// Exemplu de cod de mitigare
function safeExecuteExpression(expression) {
    // Verific─â dac─â expresia este controlat─â
    if (!isSafeExpression(expression)) {
        throw new Error('Expresie necontrolat─â');
    }

    try {
        const result = new Function('return ' + expression)();
        console.log(result);
    } catch (error) {
        console.error(error);
    }
}

function isSafeExpression(expression) {
    // Implementa╚øi o metod─â de verificare a expresiei controlate
    // Exemplu simplu: verifica dac─â expresia nu con╚øine caractere speciale neautorizate
    const specialChars = /[^a-zA-Z0-9\s]/g;
    return !specialChars.test(expression);
}

// Ușor de folosit pentru a executa expresiile controlate
safeExecuteExpression("console.log('Exploit executed successfully')");

LISTA DE MITIG─éRI

1. **Verific─â dac─â expresia este controlat─â**:

• Implementa╚øi o metod─â de verificare a expresiei controlate.
• Exemplu simplu: verifica dac─â expresia nu con╚øine caractere speciale neautorizate.

2. **Utiliza╚øi un sandbox sau o restric╚øie de cod**:

• Utiliza╚øi un environoment de execu╚øie restrictiv, cum ar fi chroot jail sau AppArmor.

3. **Asigura╚øi-v─â c─â toate inputurile sunt validificate**:

• Asigura╚øi-v─â c─â toate inputurile sunt controlate ╚Öi validificate.
• Utiliza╚øi un "accept known good" input validation strategy.

4. **Utiliza╚øi un mecanism de monitorizare a execu╚øiei**:

• Monitoriza╚øi execu╚øia codului pentru a detecta eventuali erori sau comport─âri neexpetuabile.

REFERINȚE

1. [CVE-2026-12866 - Detalii CVSS, EPSS și CISA Kev | CVE Find](https://www.cvefind.com/es/cve/CVE-2026-12866.html)
2. [GitHub Security Advisories](https://github.com/silentmatt/expr-eval/security/advisories)
3. [NVD - CVE-2026-12866](https://nvd.nist.gov/vuln/detail/CVE-2026-12866)
4. [CWE-94 Improper Control of Generation of Code ('Code Injection')](https://cwe.mitre.org/data/definitions/94.html)
5. [CISA-ADP, Snyk Weakness Enumeration CWE-ID CWE Name Source CWE-94 Improper Control of Generation of Code ('Code Injection') CISA-ADPÔÇâÔÇâ SnykÔÇâÔÇâ Change History 2 change records found show changes CVE Modified by CISA-ADP 6/23/2026 9:16:39 AM Action Type Old Value New Value Added CWE CWE-94 Added Reference https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690 Added SSVC {"timestamp":"2026-06-23T12:06:04.423419Z","id":"CVE-2026-12866","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"} New CVE Received from Snyk 6/23/2026 1:17:03 AM Action Type Old Value New Value Added Description All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-94 Added Reference https://github.com/silentmatt/expr-eval/blob/master/src/expression.js%23L55 Added Reference https://github.com/silentmatt/expr-eval/issues/292 Added Reference https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690 Added Affected [{"vendor":"n/a","product":"expr-eval","versions":[{"version":"0","lessThan":"*","versionType":"semver","status":"affected"}]}] Quick Info CVE Dictionary Entry: CVE-2026-12866 NVD Published Date: 06/23/2026 NVD Last Modified: 06/23/2026 Source: Snyk X (link is external) facebook (link is external) linkedin (link is external) youtube (link is external) rss govdelivery (link is external) HEADQUARTERS 100 Bureau Drive Gaithersburg, MD 20899 (301) 975-2000 Webmaster | Contact Us | Our Other Offices Incident Response Assistance and Non-NVD RelatedTechnical Cyber Security Questions: US-CERT Security Operations Center Email: [email┬áprotected] Phone: 1-888-282-0870 Site Privacy | Accessibility | Privacy Program | Copyrights | Vulnerability Disclosure | No Fear Act Policy | FOIA | Environmental Policy | Scientific Integrity | Information Quality Standards | Commerce.gov | Science.gov | USA.gov

References

• Related reference: https://www.cve.org/CVERecord?id=CVE-2026-12866
• Related reference: https://cwe.mitre.org/data/definitions/1434.html
• Related reference: https://cwe.mitre.org/data/definitions/1431.html
• Related reference: https://cwe.mitre.org/data/definitions/1428.html
• Related reference: https://cwe.mitre.org/data/definitions/1429.html
• Related reference: https://cwe.mitre.org/data/definitions/1427.html