CVE-2024-54152

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` globally or make sure that one uses the function with just one argument.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-541536.5In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter CVE-2024-541549.8In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox CVE-2024-541555.3In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication CVE-2024-541566.5In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack CVE-2024-541576.5In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector CVE-2024-541585.3In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding CVE-2024-541594.1stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.CVE-2024-54165.4The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url CVE-2024-541606.4dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sani CVE-2024-541696.5IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL CVE-2024-54175.4The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/pos CVE-2024-541705.5IBM EntireX 11.1 could allow a local user to cause a denial of service due to use of a regular expression with an inefficient complexity tha