Platform
nodejs
Component
angular-expressions
Fixed in
1.4.4
1.4.3
CVE-2024-54152 is a critical Remote Code Execution (RCE) vulnerability affecting the angular-expressions Node.js package. This vulnerability allows an attacker to craft malicious expressions that bypass the intended sandbox, leading to arbitrary code execution on the system. Versions of angular-expressions prior to 1.4.3 are vulnerable, and a patch has been released to address this issue.
The impact of CVE-2024-54152 is severe. An attacker can leverage this vulnerability to execute arbitrary code on the server hosting the application utilizing the vulnerable angular-expressions package. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The disclosed example demonstrates how a simple expression can already bypass the sandbox, suggesting that more complex and stealthy payloads are possible. The potential blast radius extends to any sensitive data processed or stored by the application, as well as any other systems accessible from the compromised server.
CVE-2024-54152 was publicly disclosed on December 10, 2024. The vulnerability's simplicity and the potential for easy exploitation suggest a medium probability of exploitation (EPSS score likely medium). While no public exploits have been widely reported, the ease of crafting malicious expressions makes it a likely target for opportunistic attackers. Monitor security advisories and threat intelligence feeds for any signs of active exploitation.
Exploit Status
EPSS
15.82% (95% percentile)
CISA SSVC
The primary mitigation for CVE-2024-54152 is to immediately upgrade the angular-expressions package to version 1.4.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter input validation and sanitization on any user-supplied expressions passed to the angular-expressions package. While not a complete solution, this can reduce the attack surface. Review application code for any instances where user input is directly used within expressions. There are no specific WAF rules or detection signatures readily available, so focus on code-level fixes and input validation.
Update the angular-expressions library to version 1.4.3 or higher. Alternatively, disable access to `__proto__` globally or ensure you are using the function with a single argument.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-54152 is a critical Remote Code Execution vulnerability in the angular-expressions Node.js package, allowing attackers to execute arbitrary code by crafting malicious expressions.
You are affected if your Node.js application uses angular-expressions versions 1.4.2 or earlier. Check your project dependencies immediately.
Upgrade the angular-expressions package to version 1.4.3 or later using npm or yarn. If upgrading is not possible, implement strict input validation.
While no widespread exploitation has been confirmed, the vulnerability's simplicity makes it a likely target, so vigilance is advised.
Refer to the npm advisory and related security announcements for the latest information: [https://www.npmjs.com/advisories/1732](https://www.npmjs.com/advisories/1732)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.