Notifications
Clear all
Topic starter
20/08/2026 5:31 pm
TL;DR: CVE-2026-12866 shows that expr-eval’s toJSFunction() API can turn untrusted formulas or variables into executable JavaScript inside Node.js, creating remote code execution risk in apps that treat expression builders, scoring logic, or workflow rules as data, according to Corgea. The boundary failure is architectural, not a simple patch-level issue: if attacker input reaches source generation, the application has already crossed into code execution territory.
NHIMG editorial — based on content published by Corgea: CVE-2026-12866 and the expr-eval toJSFunction() code execution risk
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when untrusted formulas reach toJSFunction() in Node.js apps?
A: The boundary breaks when expression data is converted into executable JavaScript inside the application process.
Q: Why do formula engines create hidden NHI and secrets risk?
A: Because the application process usually runs with non-human identity privileges such as cloud tokens, database access, or deployment credentials.
Q: What do teams get wrong about expression evaluation security?
A: They often assume the parser is the main control point and overlook the code-generation step.
Practitioner guidance
- Remove toJSFunction() from untrusted paths Eliminate any code path where user input, tenant input, or stored formulas reach Expression.prototype.toJSFunction().
- Treat formula variables as a data validation boundary Restrict variables passed into expression compilation to primitive values only, and reject objects, functions, and prototype-bearing payloads.
- Isolate formula execution from production secrets Run dynamic expression evaluation in a dedicated worker with no ambient cloud credentials, no signing keys, and tightly limited filesystem and network access.
What's in the full analysis
Corgea's full analysis covers the operational detail this post intentionally leaves for the source:
- The full exploit path showing how attacker-controlled input reaches new Function() through toJSFunction().
- The code-level proof of concept and payload patterns used to validate the runtime boundary failure.
- The dependency triage steps for finding expr-eval in package manifests and application call sites.
- The remediation guidance for isolating formula execution when no upstream fixed release is available.
👉 Read Corgea's analysis of CVE-2026-12866 in expr-eval →
expr-eval CVE-2026-12866: when formula evaluation turns into RCE?
Explore further
20/08/2026 6:18 pm
Formula engines are part of the application code-execution surface, not just a convenience layer. When a library like expr-eval converts expressions into JavaScript source, the security model changes from safe evaluation to source generation. That is a materially different control problem because the application is now compiling data into code at runtime. Practitioners should classify these paths alongside other execution boundaries, not alongside ordinary input handling.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How should security teams respond if attacker-controlled formulas were compiled already?
A: Treat the host as compromised at the application layer and investigate the process as if it executed attacker code. Rotate reachable secrets, check logs for formula changes and unusual payloads, and assess outbound network activity from the affected service. Re-enable execution only after the dangerous API path is removed or isolated.
👉 Read our full editorial: expr-eval CVE-2026-12866 shows formula engines can become code execution
