peerigon vulnerabilities

Products

• angular-expressions 4
• unzip-crx 1
• unzip-crx-3 1

Latest peerigon CVEs

Newest publication first

1. CVE-2026-78638 peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

   Published 2026-08-25

   Medium·CVSS 4.8 EPSS 0.17%

   A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed...

2. CVE-2026-44643 Angular Expressions - Remote Code Execution using filters

   Published 2026-05-11

   Critical·CVSS 9.3 EPSS 0.48%

   Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2.

3. CVE-2024-54152 Angular Expressions - Remote Code Execution when using locals

   Published 2024-12-10

   Critical·CVSS 9.3 EPSS 2.2%

   Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one...

4. CVE-2021-21277 Angular Expressions - Remote Code Execution

   Published 2021-02-01

   High·CVSS 8.8 EPSS 2.8%

   angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compile(userControlledInput)" where "userCont...

5. CVE-2020-5219 Remote Code Execution in Angular Expressions

   Published 2020-01-24

   High·CVSS 8.8 EPSS 2.4%

   Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.