The vulnerability CVE-2026-44643 affects the peerigon angular-expressions module used with Angular.JS. Before version 1.5.2, the module improperly sanitizes expressions evaluated dynamically, enabling an attacker to bypass sandbox restrictions via malicious filters. This leads to arbitrary code execution on the host system. The vulnerability is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). It is remotely exploitable without authentication or user interaction, with very high impact on confidentiality, integrity, and availability. The vulnerability was published on May 11, 2026, and fixed in version 1.5.2.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system without any privileges or user interaction. This can lead to full system compromise, data theft, or disruption of service. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation.

A fix is available in peerigon angular-expressions version 1.5.2. Users and organizations should upgrade to version 1.5.2 or later to remediate this vulnerability. No vendor advisory content is provided, but the description explicitly states the issue is fixed in 1.5.2. Until upgrading, avoid using vulnerable versions in production environments.