CVE-2020-5219

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
peerigon	angular-expressions	< 1.0.1

References

http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.htmlVendor Advisory
https://github.com/peerigon/angular-expressions/commit/061addfb9a9e932a970e5fcb913d020038e65667Patch
https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43Mitigation, Third Party Advisory
http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.htmlVendor Advisory
https://github.com/peerigon/angular-expressions/commit/061addfb9a9e932a970e5fcb913d020038e65667Patch
https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43Mitigation, Third Party Advisory

Timeline

Published: Jan 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52205.3Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an CVE-2020-52217.2In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP comman CVE-2020-52228.8Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. CVE-2020-52234.4In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user pro CVE-2020-52248.8In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key CVE-2020-52255.4Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email t CVE-2020-52265.4Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to CVE-2020-52277.5Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content CVE-2020-52287.5Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the defau CVE-2020-52298.1Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes ar CVE-2020-52307.5Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for oper CVE-2020-52316.5In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the