CVE-2026-44643: Angular Expressions Remote Code Execution Vulnerability
Summary
CVE-2026-44643: Angular Expressions - Remote Code Execution using filters. Affects angular-expressions versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular Expressions is a JavaScript library that allows developers to evaluate expressions in Angular applications. It provides a way to create dynamic expressions that can be used in various contexts, such as data binding and filtering. However, the library has a critical vulnerability that allows attackers to execute arbitrary code by exploiting the expression evaluation mechanism.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to craft a malicious expression that bypasses the library's sandboxing mechanism. This can lead to remote code execution on the affected system. For example, using the expression 'a | proto' should trigger an error indicating that the filter is not defined. Instead, it results in a SyntaxError, which can be exploited with a more complex payload to gain full access to the system. The affected versions are angular-expressions versions 1.5.1 and below.
How To Fix
Latest published version: 1.7.1 as of 23 Oct 2026
npm install angular-expressions@1.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
npm install angular-expressions@1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using any expressions that could potentially exploit the proto filter or similar constructs until you can update to the patched version. Ensure to validate and sanitize any user inputs that may be passed to the expression evaluator.
Conclusion
The CVE-2026-44643 vulnerability in angular-expressions allows for remote code execution due to improper handling of expressions. It is crucial to update to version 1.5.2 or later to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for angular-expressions →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical severity level.
Versions of angular-expressions that are affected include all versions up to and including 1.5.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability was discovered by San Gil from securityoffice.io.
If you cannot update the package immediately, ensure to validate and sanitize user inputs and avoid using potentially dangerous expressions.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular-expressions.
