CVE-2020-5219

Description

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

Weakness classification

• security-advisories@github.com: CWE-74
• nvd@nist.gov: CWE-74

Primary references

• security-advisories@github.com — Vendor Advisory
• security-advisories@github.com — Patch
• security-advisories@github.com — Mitigation, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch
• af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory