Angular Expressions Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Angular Expressions versions prior to 1.0.1. The issue arises when user-controlled input is passed to the `expressions.compile()` function. In a browser environment, this could allow an attacker to execute arbitrary scripts. On the server side, any JavaScript expression could be executed, leading to remote code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the server or client side, depending on where Angular Expressions is used.

Reproduction

To reproduce this vulnerability, use Angular Expressions version prior to 1.0.1 and call the `expressions.compile()` method with user-controlled input. This can be done in a browser environment, where the compiled expression will be executed as a script, or on the server, where it will be executed as JavaScript code.

Remediation

Upgrade Angular Expressions to version 1.0.1 or later.