CVE-2026-44643: Sandbox Escape and Remote Code Execution in angular-expressions

Vulnerability ID: CVE-2026-44643

CVSS Score: 9.3

Published: 2026-05-11

CVE-2026-44643 is a critical sandbox escape vulnerability in the peerigon/angular-expressions library. The flaw permits unauthenticated remote code execution via prototype traversal and improper validation of filter expressions. By crafting specific malicious inputs, attackers can access the global Function constructor.

TL;DR

A critical sandbox escape in angular-expressions < 1.5.2 allows RCE via prototype traversal in malicious filter definitions.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-95

CVSS v4.0 : 9.3

Attack Vector : Network

Impact : Remote Code Execution (RCE)

Privileges Required : None

CISA KEV Status : Not Listed

Affected Systems

Node.js environments utilizing peerigon/angular-expressions

Browser applications relying on client-side expression evaluation

angular-expressions : < 1.5.2 (Fixed in: 1.5.2 )

Mitigation…