Vulnerability in Peerigon Angular-expressions
CVE-2021-21277
angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.comp…
EPSS: 0.003 (55.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N.
Affected products
- Peerigon Angular-expressions — versions < 1.1.2
Weakness classification (CWE)
References
- github.com/peerigon/angular-expressions/security/advisories/GHSA-j6px-jwvv-vpwq (x_refsource_CONFIRM)
- www.npmjs.com/package/angular-expressions (x_refsource_MISC)
- blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html (x_refsource_MISC)
- github.com/peerigon/angular-expressions/commit/07edb62902b1f6127b3dcc013da61c63… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-21277?
- CVE-2021-21277 is a high-severity vulnerability in Peerigon Angular-expressions, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.5/10. Published 2021-02-01.
- How severe is CVE-2021-21277?
- High severity. CVSS v3 base score is 8.5 out of 10.