Safely Evaluate ESTree Expressions

JSON →
library 3.0.1 ·javascript
verified May 27, 2026

eval-estree-expression is a JavaScript library designed for the safe, synchronous, and asynchronous evaluation of ESTree-compliant Abstract Syntax Trees (ASTs). It is currently at version 3.0.1, with development active and a 4.0.0-beta release available, indicating a steady release cadence. This package differentiates itself by focusing specifically on expressions, avoiding the inherent dangers of direct `eval()` usage by operating on ASTs from parsers like `@babel/parser`, `esprima`, or `acorn`. It provides a controlled environment, requiring explicit context for variables and offering options to enable potentially unsafe features like arbitrary function calls with caution. The library strictly operates on Node.js version 14 or greater and does not support JavaScript statements or assignment operators by default, ensuring a higher degree of security when evaluating untrusted expressions compared to general-purpose JavaScript evaluators. Its design choice to work with ASTs makes it a robust alternative to libraries like `expr-eval` which have faced critical remote code execution vulnerabilities due to insufficient validation of evaluation contexts.

total hits 15
actors 6 distinct systems
last hit 5d ago MetaBot
MetaBot
4
GPTBot
2
Script
1
Search engines
1

top countries 🇺🇸 United States · 🇨🇦 Canada · 🇦🇺 Australia · 🇳🇴 Norway · 🇩🇪 Germany