A critical prototype pollution vulnerability in the expr-eval npm package allows unauthenticated remote attackers to achieve arbitrary code execution on systems processing malicious input.

The vulnerability stems from improper control over object prototype attributes (CWE-1321). An unauthenticated attacker can manipulate the JavaScript prototype chain through the express eval interface to execute arbitrary code within the context of the application.

Successful exploitation of this flaw can lead to a full compromise of the application server, allowing for unauthorized data access, modification, or complete system takeover. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the integrity and availability of any infrastructure utilizing the affected package for expression evaluation.

Immediate Action: Migrate from the vulnerable expr-eval package to the expr-eval-fork package, which resolves this issue in version 2.0.2.

Proactive Monitoring: Review application logs for unusual JavaScript object property modifications or attempts to access restricted system modules like child_process or fs.

Compensating Controls: Implement input validation to sanitize expressions before they reach the eval interface and consider deploying a Web Application Firewall with rules configured to block common prototype pollution injection patterns.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up referenced in the CVE record.

Organizations using the silentmatt expr-eval package must prioritize migrating to the maintained expr-eval-fork repository immediately. Given the availability of public proof-of-concept code and the high potential impact of arbitrary code execution, this remediation is necessary to prevent unauthorized system access.