[Bug]: Dependency on expr-eval-fork creates vulnerability

[boycarper]

What happened?

expr-eval-fork has been flagged as a ciritcal vulnerability.

See: https://www.mend.io/vulnerability-database/CVE-2025-12735

Reproduction

No response

Expected output

No response

Version

2.0.1

[DarioSoller]

Also an issue in my project and my company's security repo scans.

@jorenbroekema do you already have ideas how to get the expression eval thing secure? It's probably needed for the math executions, right? i fear this could be a tricky one to get complaint with the standard security checks out there!?

[jorenbroekema]

Yeah so I had to fork this to get a security fix published and now it seems I have inherited the library somewhat, because I've been getting a lot of emails about security CVEs for my fork now (since the origin has been abandoned). I already managed to fix one of them and there's an open PR on my fork for fixing member access issue which I'm hoping to fix/publish this weekend.

I can't guarantee that sd-transforms will be published with a fix afterwards though since I no longer work for Tokens Studio and I don't have publish access to this lib. I'll create a PR and shoot them a message to see if they can get it merged/published by then.

Also, yes it's a bit tricky to handle "security" on a library that evaluates strings as code execution, there's always an inherent risk to them, I think the trick is to deal with the most egregious vectors of attack and tolerate others somewhat. So yeah even these CVEs that are being raised, I'm scratching my head a lot on whether they are actual problems and whether the proposed solutions are really solutions to them.. but I'm erring on the side of just trusting the security experts there and going with their suggestions.