Peerigon
Monthly
Remote code execution in angular-expressions versions ≤1.5.1 allows unauthenticated network attackers to escape the expression sandbox via malicious filter payloads and execute arbitrary system commands with no user interaction required. CVSS 9.3 (Critical) with confirmed public exploit code available. Vendor-released patch in version 1.5.2 addresses the sandbox escape. Affects applications using angular-expressions as a standalone module for evaluating user-supplied Angular.JS expressions.
Path traversal in peerigon unzip-crx and unzip-crx-3 (versions up to 0.2.0) enables a local, low-privileged attacker to write extracted archive files outside the intended destination directory by supplying a crafted path argument to the unzip() function. A publicly available proof-of-concept exploit exists via the GitHub issue tracker, and no vendor patch has been released as the project has not responded to the disclosure. The integrity impact is limited to arbitrary file placement on the local filesystem within the privileges of the invoking process.
angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Remote code execution in angular-expressions versions ≤1.5.1 allows unauthenticated network attackers to escape the expression sandbox via malicious filter payloads and execute arbitrary system commands with no user interaction required. CVSS 9.3 (Critical) with confirmed public exploit code available. Vendor-released patch in version 1.5.2 addresses the sandbox escape. Affects applications using angular-expressions as a standalone module for evaluating user-supplied Angular.JS expressions.
Path traversal in peerigon unzip-crx and unzip-crx-3 (versions up to 0.2.0) enables a local, low-privileged attacker to write extracted archive files outside the intended destination directory by supplying a crafted path argument to the unzip() function. A publicly available proof-of-concept exploit exists via the GitHub issue tracker, and no vendor patch has been released as the project has not responded to the disclosure. The integrity impact is limited to arbitrary file placement on the local filesystem within the privileges of the invoking process.
angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.