Angular Expressions is a standalone module for the Angular.JS web framework. Prior to version 1.5.2 an attacker can craft a malicious expression that uses filters to escape the sandbox and execute arbitrary code on the system. The flaw provides Remote Code Execution capabilities, classified as CWE‑95 input validation failure.

The vulnerability affects the Angular Expressions package from peerigon. Versions prior to 1.5.2 are impacted; the fix is released in version 1.5.2.

The Common Vulnerability Scoring System assigns the issue a high severity of 9.3, indicating a severe impact if exploited. EPSS data is not available, and the flaw is not currently listed in CISA’s KEV catalog. The attack vector is inferred to be remote; an attacker must be able to supply a crafted expression to a vulnerable application that evaluates Angular Expressions, which typically occurs through user input on a web interface.