CVE-2020-5219

Katalog CVE

CVSS 8.8 · High EPSS 2,4%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada peerigon angular-expressions. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

Rincian

Terbit di NVD

24 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html advisory vendor
• https://github.com/peerigon/angular-expressions/commit/061addfb9a9e932a970e5fcb913d020038e65667 patch
• https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43 mitigasi · advisory pihak ketiga