{"uuid": "b2eebc8c-071b-4a0e-b4f7-6ac89628c017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12866", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mowpwxfz6z2b", "content": "expr-eval (all versions) hit by CRITICAL RCE (CVE-2026-12866): attackers can run arbitrary JS via toJSFunction(). No patch \u2014 avoid untrusted input now. https://radar.offseq.com/threat/cve-2026-12866-code-execution-in-expr-eval-90f740bedba0af48 #OffSeq #vulnerability #AppSec", "creation_timestamp": "2026-06-23T06:00:56.740747Z"}