Vulnerabilities in pkg:npm/angular-expressions

PACKAGE
Advisory Identifier: GHSA-pw8r-6689-xvf4
Share
Advisory Summary

CVE-2026-44643 is a CRITICAL remote code execution vulnerability (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')) affecting Angular expressions libraries in the npm ecosystem. The issue involves angular expressions - remote code execution using filters. Remediation is available by upgrading affected packages to version 1.5.2.

4 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:npm/angular-expressions

4 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:npm/angular-expressions. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-pw8r-6689-xvf4 CVE-2026-44643 CRITICAL Angular Expressions - Remote Code Execution using filters
GHSA-5462-4vcx-jh7j CVE-2024-54152 CRITICAL Angular Expressions - Remote Code Execution when using locals
GHSA-j6px-jwvv-vpwq CVE-2021-21277 HIGH Angular Expressions - Remote Code Execution
GHSA-hxhm-96pp-2m43 CVE-2020-5219 HIGH Remote Code Execution in Angular Expressions

CVE-2026-44643 at a Glance

CVE Identifier CVE-2026-44643
GHSA Identifier GHSA-pw8r-6689-xvf4
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected Product Angular expressions
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2026-44643

To remediate this vulnerability, upgrade all affected Angular expressions dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

angular-expressions fixed: 1.5.2 
npm install angular-expressions@1.5.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls angular-expressions

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-44643, inspect your project dependencies using npm:

npm ls angular-expressions

Analyze the terminal output to locate any version of Angular expressions in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.5.2), your application is affected.

Note: The npm ls angular-expressions command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). In Angular expressions, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Impact An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. Example of vulnerable code: ``` const expressions = require("angular-expressions"); const result = expressions.compile("a | __proto__")({}, {}); ``` This should throw the error : Filter '__proto__' is not defined, however, this shows : Uncaught SyntaxError: Unexpected identifier 'Object' With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. ## Vulnerable versions : angular-expressions <= 1.5.1 ## Patches The problem has been patched in version 1.5.2 of angular-expressions. ## Credits Credits go to San Gil from [www.securityoffice.io](https://securityoffice.io/) who has found the issue and reported it to us.

CVE-2026-44643 Affected Angular expressions Versions

1 component(s)
Fixed Versions:
1.5.2
Product / Package Ecosystem Affected Versions Fixed Version
angular-expressions
npm/angular-expressions
npm
< 1.5.2
1.5.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/peerigon/angular-expressions/security/advisories/GHSA-pw8r-6689-xvf4
NVD — CVE-2026-44643 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44643
Angular expressions Source Repository REPOSITORY
https://github.com/peerigon/angular-expressions

Frequently Asked Questions

What is CVE-2026-44643?
CVE-2026-44643 is a security vulnerability in Angular expressions involving Angular Expressions - Remote Code Execution using filters under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection').
Which Angular expressions versions are affected?
Affected versions include releases prior to 1.5.2 across affected packages: angular-expressions.
What version fixes CVE-2026-44643?
Upgrading to 1.5.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is angular-expressions affected?
Yes, angular-expressions is affected in releases prior to 1.5.2. Upgrade your dependency to 1.5.2 or later.
What CWE is associated with CVE-2026-44643?
CVE-2026-44643 is classified under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").).
How can I check npm dependencies for CVE-2026-44643?
Run the dependency tree command: 'npm ls angular-expressions'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pw8r-6689-xvf4",
  "modified" : "2026-05-13T13:53:12Z",
  "published" : "2026-05-11T16:20:58Z",
  "aliases" : [ "CVE-2026-44643" ],
  "summary" : "Angular Expressions - Remote Code Execution using filters",
  "details" : "## Impact\n\nAn attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system.\n\nExample of vulnerable code:\n\n```\nconst expressions = require(\"angular-expressions\");\nconst result = expressions.compile(\"a | __proto__\")({}, {});\n```\n\nThis should throw the error : Filter '__proto__' is not defined, however, this shows : \n\nUncaught SyntaxError: Unexpected identifier 'Object'\n\nWith a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system.\n\n## Vulnerable versions : \n\nangular-expressions <= 1.5.1\n\n## Patches\n\nThe problem has been patched in version 1.5.2 of angular-expressions.\n\n## Credits\n\nCredits go to San Gil from [www.securityoffice.io](https://securityoffice.io/) who has found the issue and reported it to us.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "angular-expressions"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.5.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/peerigon/angular-expressions/security/advisories/GHSA-pw8r-6689-xvf4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44643"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/peerigon/angular-expressions"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-95" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-11T16:20:58Z",
    "nvd_published_at" : "2026-05-11T16:17:36Z"
  }
}