CVE-2024-54152: Angular Expressions Remote Code Execution Vulnerability
Summary
CVE-2024-54152: Angular Expressions - Remote Code Execution when using locals. Affects angular-expressions versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Angular Expressions is a JavaScript library that allows for the evaluation of expressions in Angular applications. It provides a simple way to bind data and execute expressions dynamically. However, certain versions of this library are vulnerable to a remote code execution flaw that can be exploited by attackers to execute arbitrary code on the host system.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to craft a malicious expression that escapes the sandbox environment of Angular Expressions. Specifically, the issue is present in versions of the library up to 1.4.2, where executing an expression like 'proto.constructor' can lead to unintended behavior, returning an object instead of undefined. This flaw can be exploited with more complex payloads to gain full access to the system, posing a critical security risk.
How To Fix
Latest published version: 1.7.1 as of 23 Oct 2026
npm install angular-expressions@1.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
npm install angular-expressions@1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version, a temporary workaround is to ensure that you use the compiled function with only one argument. For example:
const result =
expressions.
compile('__proto__.constructor')({});
This approach disables the locals feature but mitigates the vulnerability.
Conclusion
The vulnerability identified as CVE-2024-54152 in the angular-expressions package poses a significant security risk due to its potential for remote code execution. It is crucial for users of this library to update to version 1.4.3 or implement the provided workaround to safeguard their applications.
See every vulnerability recorded for angular-expressions →
FAQ
The vulnerability allows for remote code execution through crafted expressions that escape the sandbox of Angular Expressions.
Versions up to and including 1.4.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, an attacker could execute arbitrary code on the system, potentially leading to data breaches or system compromise.
Yes, you can use the workaround of compiling expressions with only one argument to reduce the risk until you can update.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular-expressions.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
