Description
An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system.
Recommendation
Update the angular-expressions package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.5.1
- Patched version(s): 1.5.2
References
Could your website be exposed too?
SmartScanner can check your website for Angular Expressions - Remote Code Execution using filters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Angular Expressions - Remote Code Execution when using locals - CVE-2024-54152
- Remote Code Execution in Angular Expressions - CVE-2020-5219
- Angular Expressions - Remote Code Execution - CVE-2021-21277
- Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas - CVE-2026-41138
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2026


