CVE-2026-44643 is a critical code injection flaw (CVSS 10.0 in the record) in angular-expressions, an npm package that evaluates Angular style expressions. A crafted expression using filters can escape its sandbox and run code. Versions up to 1.5.1 are affected. Upgrade to 1.5.2 and check transitive copies too.
What's affected
From the project advisory for the angular-expressions npm package:
- Affected: 1.5.1 and earlier.
- Fixed: 1.5.2.
Applications are exposed when they compile expressions that come from users, from templates users can edit, or from any other source an outsider can influence. Libraries that depend on angular-expressions, such as document templating tools, can pull it in without you noticing, so check the dependency tree and not only your direct dependencies.
How to check if you're exposed
List every copy in your dependency tree:
npm ls angular-expressions
Use npm explain angular-expressions to see which package brings it in. Also check lock files across repositories and container images:
grep -rn "angular-expressions" package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
Any resolved version at or below 1.5.1 needs action.
What to do now
- Upgrade to angular-expressions 1.5.2 or later, and force the version through overrides or resolutions if a dependency pins an older one.
- Rebuild and redeploy images that contain the old version.
- Stop compiling expressions from untrusted input where possible, or restrict it to a fixed set of parameters you control.
- Review logs and code paths where users supply expression text.
Why it matters
The class is CWE-95 (eval injection). The package promises that expressions run in a limited environment, with access to a scope object and a list of filters. A sandbox like this is only as strong as every route into it. The advisory shows that a filter name that resolves to special object properties produces an unexpected error rather than the expected "filter is not defined", which signals that the lookup reaches outside the intended set. The full technique is not published, and this article does not describe it.
Sandboxes for expression languages have a history of escapes in JavaScript, because the language exposes constructors and prototypes on every object. The safest design is not to evaluate user supplied expressions at all.
The record does not mark this CVE as KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be using angular-expressions directly?
No. It can arrive as a transitive dependency, so check the full dependency tree.
Sources
Last reviewed: 19 October 2026.
