Vulnerability · Published Jan 24, 2020 · Assigned by GitHub_M

CVE-2020-5219Remote Code Execution in Angular Expressions

High 8.7

In plain English

A high-severity injection in angular-expressions from peerigon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)2.4%top 15.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	angular-expressions	1.0.1	GHSA-hxhm-96pp-2m43

Affected products (as reported)

Vendor	Product	Versions
peerigon	angular-expressions	< 1.0.1

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43 x_refsource_CONFIRM
https://github.com/peerigon/angular-expressions/commit/061addfb9a9e932a970e5fcb913d020038e65667 x_refsource_MISC
http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html x_refsource_MISC