CVE-2024-54152

What it actually does

Sandbox escape in Angular Expressions allows a malicious expression to break out and execute arbitrary code on the host system, including with complex payloads achieving full arbitrary code execution.

Why it matters to the business

Attackers can gain full control of affected systems processing untrusted expressions, leading to data theft, service disruption, or further compromise; the package is widely depended on in web applications using AngularJS.

How an attack unfolds

An attacker supplies a crafted expression to an Angular Expressions evaluation point; the expression manipulates __proto__ or other properties to escape the sandbox and run arbitrary JavaScript or system commands, potentially achieving full remote code execution.

How to fix it

Upgrade peerigon/angular-expressions to commit e422a8c9abd22c7c450131f89283515f68893daa (version 1.4.3 or later). As workarounds, globally disable __proto__ access or ensure the evaluate function is always called with exactly one argument.

How to confirm the fix worked

Verify the installed version of angular-expressions is 1.4.3 or newer by checking package.json, package-lock.json, or running npm list angular-expressions; test that previously working sandbox-escape expressions are now blocked.

Typical attack path

1. Identify an application endpoint or feature that evaluates user-controlled or attacker-influenced expressions with Angular Expressions
2. Craft a malicious expression payload that accesses or modifies prototype chains to break sandbox restrictions
3. Trigger evaluation of the payload to execute arbitrary code
4. Escalate to full system access or persistence using the resulting code execution capability

How to detect it

Review application logs and web request logs for unusual or complex expressions containing __proto__, constructor, or prototype manipulation patterns; inspect process execution or file system changes following expression evaluation points.

What your security team should do

• Immediately upgrade all instances of angular-expressions to the fixed commit or version 1.4.3
• Audit applications for any use of evaluate() with untrusted input and restrict expression sources
• Implement the __proto__ workaround or single-argument usage where upgrades are delayed
• Monitor dependency scanners for any remaining vulnerable versions in the ecosystem