CVE-2020-5219
High
Description
Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.
SeverityHigh
CVSS8.7
Exploit probability—
ProductPeerigon Angular-expressions
PublishedJan 24, 2020
First seenJan 24, 2020
Weakness typeCWE-74Injection
How to fix
Update
- peerigon angular-expressions1.0.1 or later
- angular-expressions1.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| peerigon angular-expressions | v < 1.0.1 | 1.0.1 |
| angular-expressionsnpm | v < 1.0.1 | 1.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.