- Latest release
- 1.7.1 (Oct 12, 2026): no advisory affects it
- Newest unaffected release
- 1.7.1 (Oct 12, 2026), the latest release
- Advisories
- 4 · 2 critical, 2 high
- Weekly downloads
- 207K
- Dependents
- 59
- Releases
- 33 since 0.1.0 (Mar 16, 2014)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-44643Affects 0.1.0 to 1.5.1 (1.5.2 is outside it)
- CVE-2024-54152Affects 0.1.0 to 1.4.2 (1.4.3 is outside it)
- CVE-2021-21277Affects 0.1.0 to 1.1.1 (1.1.2 is outside it)
- CVE-2020-5219Affects 0.1.0 to 1.0.0 (1.0.1 is outside it)
Advisories 4
- CVE-2026-44643Critical 9.3
Angular Expressions - Remote Code Execution using filters
Affected: fixed in 1.5.2.
Fixed in 1.5.2 (released May 7, 2026, 4 days before disclosure).
The latest release, 1.7.1, is not affected.
23% of angular-expressions downloads last week were affected versions (55.3K).
- CVE-2024-54152Critical 9.3
Angular Expressions - Remote Code Execution when using locals
Affected: fixed in 1.4.3.
Fixed in 1.4.3 (released Dec 10, 2024, the day of disclosure).
The latest release, 1.7.1, is not affected.
4.4% of angular-expressions downloads last week were affected versions (10.3K).
- CVE-2021-21277High 8.5
Angular Expressions - Remote Code Execution
Affected: fixed in 1.1.2.
Fixed in 1.1.2 (released Jan 29, 2021, 3 days before disclosure).
The latest release, 1.7.1, is not affected.
1.7% of angular-expressions downloads last week were affected versions (4.1K).
- CVE-2020-5219High 8.7
Remote Code Execution in Angular Expressions
Affected: fixed in 1.0.1.
Fixed in 1.0.1 (released Jan 23, 2020, 1 day before disclosure).
The latest release, 1.7.1, is not affected.
1.5% of angular-expressions downloads last week were affected versions (3.6K).