EUVD-2020-0267

Malware in sbrugna...

CVE-2021-21277: Improper Neutralization of Special Elements in Output Used by a Downstream Component

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compileuserControlledInput" where "userControlledInput" is tex...

CVE-2020-5219: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...