PT-2026-39620

CVE-2026-44643

Published

2026-05-11

Updated

2026-05-11

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions angular-expressions versions prior to 1.5.2

Description An issue in the angular-expressions library allows unauthenticated attackers to escape the sandbox and execute arbitrary code on the host system. This is achieved by crafting malicious expressions using filters, such as abusing proto, which triggers an eval injection (a technique where an application executes dynamically generated code).

Recommendations Update to version 1.5.2.

Exploitability

Exploit

Fix

Impacts

Researchers

San Gil

Vendors

Affected products

Weakness enumeration

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')

Related identifiers