{"id":"CVE-2021-21277","aliases":["EUVD-2021-0555","GHSA-j6px-jwvv-vpwq"],"status":"published","title":"Angular Expressions - Remote Code Execution","description":"angular-expressions is \"angular's nicest part extracted as a standalone module for the browser and node\". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call \"expressions.compile(userControlledInput)\" where \"userControlledInput\" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a \".constructor.constructor\" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02848,"percentile":0.86882,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-94"],"published":"2021-02-01T15:01:26Z","modified":"2026-10-20T10:54:27Z","fixes":[{"ecosystem":"npm","package":"angular-expressions","fixed_in":["1.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"angular-expressions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"angular-expressions","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]}],"products":[{"vendor":"peerigon","product":"angular-expressions"}],"references":[{"url":"https://github.com/peerigon/angular-expressions/security/advisories/GHSA-j6px-jwvv-vpwq","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.npmjs.com/package/angular-expressions","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html","tags":["x_refsource_MISC","x_transferred","Broken Link","Vendor Advisory","advisory","web"]},{"url":"https://github.com/peerigon/angular-expressions/commit/07edb62902b1f6127b3dcc013da61c6316dd0bf1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21277","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j6px-jwvv-vpwq"}],"sources":{"cve":[{"id":"CVE-2021-21277","title":"Angular Expressions - Remote Code Execution","description":"angular-expressions is \"angular's nicest part extracted as a standalone module for the browser and node\". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call \"expressions.compile(userControlledInput)\" where \"userControlledInput\" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a \".constructor.constructor\" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.","status":"published","published":"2021-02-01T15:05:24Z","modified":"2024-08-03T18:09:15.102Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-0555","description":"angular-expressions is \"angular's nicest part extracted as a standalone module for the browser and node\". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call \"expressions.compile(userControlledInput)\" where \"userControlledInput\" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a \".constructor.constructor\" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.","status":"published","published":"2021-02-01T15:05:24Z","modified":"2024-08-03T18:09:15Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:25:06.913643Z"}],"ghsa":[{"id":"GHSA-j6px-jwvv-vpwq","title":"Angular Expressions - Remote Code Execution","description":"### Impact\n\nThe vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.\n\nThis time, the security of the package could be bypassed by using a more complex payload, using a `.constructor.constructor` technique.\n\n* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).\n* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.\n\n### Patches\n\nUsers should upgrade to version 1.1.2 of angular-expressions\n\n### Workarounds\n\nA temporary workaround might be either to : \n\n* disable user-controlled input that will be fed into angular-expressions in your application\n\nOR\n\n* allow only following characters in the userControlledInput : \n\n```js\nif (/^[|a-zA-Z.0-9 :\"'+-?]+$/.test(userControlledInput)) {\n      var result = expressions.compile(userControlledInput);\n}\nelse {\n     result = undefined;\n}\n```\n\n### References\n\n[Removal of angular-expression sandbox](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [angular-expressions](https://github.com/peerigon/angular-expressions/issues)\n* [Email us](mailto:contact@javascript-ninja.fr)\n\n### Credits \n\nThe issue was reported by Maxime Nadeau from GoSecure, Inc.","status":"published","published":"2021-02-01T15:01:26Z","modified":"2023-02-01T05:05:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:36:32.918681Z"}],"nvd":[{"id":"CVE-2021-21277","description":"angular-expressions is \"angular's nicest part extracted as a standalone module for the browser and node\". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call \"expressions.compile(userControlledInput)\" where \"userControlledInput\" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a \".constructor.constructor\" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.","status":"published","published":"2021-02-01T15:15:13.34Z","modified":"2026-06-17T03:35:10.707Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"CVE-2021-21277","description":"angular-expressions is \"angular's nicest part extracted as a standalone module for the browser and node\". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call \"expressions.compile(userControlledInput)\" where \"userControlledInput\" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a \".constructor.constructor\" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.","status":"published","published":"2021-02-01T15:15:13.34Z","modified":"2026-10-20T10:54:27.868618406Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"GHSA-j6px-jwvv-vpwq","title":"Angular Expressions - Remote Code Execution","description":"### Impact\n\nThe vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.\n\nThis time, the security of the package could be bypassed by using a more complex payload, using a `.constructor.constructor` technique.\n\n* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).\n* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.\n\n### Patches\n\nUsers should upgrade to version 1.1.2 of angular-expressions\n\n### Workarounds\n\nA temporary workaround might be either to : \n\n* disable user-controlled input that will be fed into angular-expressions in your application\n\nOR\n\n* allow only following characters in the userControlledInput : \n\n```js\nif (/^[|a-zA-Z.0-9 :\"'+-?]+$/.test(userControlledInput)) {\n      var result = expressions.compile(userControlledInput);\n}\nelse {\n     result = undefined;\n}\n```\n\n### References\n\n[Removal of angular-expression sandbox](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [angular-expressions](https://github.com/peerigon/angular-expressions/issues)\n* [Email us](mailto:contact@javascript-ninja.fr)\n\n### Credits \n\nThe issue was reported by Maxime Nadeau from GoSecure, Inc.","status":"published","published":"2021-02-01T15:01:26Z","modified":"2026-09-10T03:49:14.136872209Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}