{"uuid": "aff63590-45e4-4f0d-8e6b-25b8890c63fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-12866", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116797893970275740", "content": "CVE-2026-12866 | CRITICAL severity in expr-eval (all versions): Arbitrary code execution via toJSFunction() API. No patch yet \u2014 avoid untrusted input. Risk: full app compromise. Details: https://radar.offseq.com/threat/cve-2026-12866-code-execution-in-expr-eval-90f740bedba0af48 #OffSeq #infosec #security #CVE202612866", "creation_timestamp": "2026-06-23T06:00:34.675186Z"}