DOM based AngularJS sandbox escapes
Summary: PortSwigger researcher Gareth Heyes documented a method for escaping the AngularJS sandbox inside the order by filter, a context where Angular expressions execute without the {{ }} delimiters and where $eval and $$watchers are unavailable. The write-up traces sandbox escapes from Angular 1.0 through 1.5.11, including Jan Horn's 1.2.0 bypass using sub and call.call, before Angular removed the sandbox entirely in version 1.6 for performance reasons and because it was not considered a security feature.
Bottom line: Angular dropped its sandbox in 1.6 on the position that it was never a security control, so any application still running a 1.x branch and passing user input such as location.hash into an order by filter is relying on a boundary the framework's own maintainers declined to defend.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026