Log in Start free

Vulnerability · Published Feb 1, 2021 · Assigned by GitHub_M

CVE-2021-21277Angular Expressions - Remote Code Execution

High 8.5

In plain English

A high-severity injection in angular-expressions from peerigon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)2.8%top 13.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compile(userControlledInput)" where "userControlledInput" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a ".constructor.constructor" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmangular-expressions1.1.2GHSA-j6px-jwvv-vpwq

Affected products (as reported)

VendorProductVersions
peerigon angular-expressions < 1.1.2

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

References