PT-2026-39620 · Npm · Angular-Expressions

San Gil · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-44643

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions angular-expressions versions prior to 1.5.2

Description An issue in the angular-expressions library allows unauthenticated attackers to escape the sandbox and execute arbitrary code on the host system. This is achieved by crafting malicious expressions using filters, such as abusing proto, which triggers an eval injection (a technique where an application executes dynamically generated code).

Recommendations Update to version 1.5.2.

Exploit

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-44643

GHSA-PW8R-6689-XVF4

Affected Products

Angular-Expressions

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44643.json · Exploit
• https://github.com/peerigon/angular-expressions/security/advisories/GHSA-pw8r-6689-xvf4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44643 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pw8r-6689-xvf4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44643 · Security Note
• https://github.com/peerigon/angular-expressions · Note
• https://twitter.com/CVEnew/status/2053954474201207280 · Twitter Post
• https://twitter.com/UpwindMDR/status/2053880333024608600 · Twitter Post