angular-expressions CVE-2026-44643

Requires applications using angular-expressions library to invoke expressions.compile() on attacker-controlled input. Specifically vulnerable when user-supplied strings are passed as the first argument to compile() for dynamic expression evaluation. Common attack surfaces include: template systems rendering user-defined layouts, API endpoints accepting filter/query expression syntax, CMS platforms with custom field logic, or dashboard builders with expression-based data transformations. The vulnerability does NOT require any specific configuration beyond default angular-expressions usage - standard installation with any version ≤1.5.1 processing untrusted input is exploitable. CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, special network position, or user interaction limits exploitation. Attack succeeds against default configurations when user input reaches expression compilation without strict allow-list validation.

CVSS 9.3 (Critical) with vector AV:N/AC:L/PR:N/UI:N indicates maximum exploitability - remote unauthenticated attackers can exploit without complex conditions or user interaction. Publicly available exploit code exists (GitHub Gist by alon710), significantly lowering the attacker skill threshold. Vendor advisory from peerigon confirms the issue with proof-of-concept showing '__proto__' filter abuse leading to arbitrary code execution. Real-world risk is HIGH for applications that: (1) use angular-expressions to evaluate user-controlled input, (2) deploy in server-side contexts (Node.js template engines, API validators), and (3) have not updated to 1.5.2+. The combination of network attack vector, no authentication requirement, and available exploit code creates immediate exposure. EPSS data not provided but exploit availability and sandbox escape nature suggest active scanning/exploitation is probable. Priority remediation recommended for any instance processing untrusted expressions, particularly in multi-tenant or internet-facing environments where expression inputs originate from external users.

An attacker identifies a web application using angular-expressions to render user-customizable dashboard widgets where expression syntax controls data display. The attacker submits a crafted expression payload containing '__proto__' filter references (e.g., 'a | __proto__' or more complex undisclosed chains) through the widget configuration API. When the server compiles this expression via expressions.compile(), the malicious filter escapes the sandbox by manipulating JavaScript prototype chain, gaining access to Node.js runtime functions. The attacker executes arbitrary system commands (file system access, reverse shell establishment, lateral movement to internal services) with the privileges of the Node.js process, typically a web service account with database and internal network access.