PT-2026-39620 · Peerigon · Angular-Expressions

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-44643

Mitre

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2.

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-44643

Affected Products

Angular-Expressions

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-44643 · Security Note
• https://github.com/peerigon/angular-expressions/security/advisories/GHSA-pw8r-6689-xvf4 · Note