Angular
Monthly
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript execution in end-user browsers when untrusted input is serialized inside template content nested within fallback raw-content elements (noscript, iframe, noembed, noframes) on versions prior to 20.3.30, 21.2.22, and 22.1.4. The root cause is a traversal bug in Angular's Domino serializer: the ancestor-tag walk that determines whether closing tags must be escaped stopped at DocumentFragment boundaries (the type returned by template.content), so unescaped closing tags could break out of their container and activate attacker-controlled markup when the browser's HTML5 RAWTEXT parser processes the server-rendered HTML. No public exploit or CISA KEV listing exists at time of analysis, but the Renderer2 imperative DOM construction path is unconditionally exploitable in all affected versions regardless of schema configuration.
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript execution in a victim's browser when attacker-controlled data reaches a `ProcessingInstruction` DOM node serialized inside an HTML5 RAWTEXT fallback container. Affected Angular versions prior to 20.3.30, 21.2.22, and 22.1.4 use a `domino` library build that escapes `>` in ProcessingInstruction data but not `<`, permitting a crafted closing tag such as `</noscript>` to prematurely terminate the RAWTEXT container and cause sibling elements to render as live HTML. The vulnerability is confirmed by GitHub Security Advisory GHSA-j3r3-mxqp-r2p4 with patches released across all three active Angular major release lines; no public exploit or CISA KEV listing exists at time of analysis.
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins via a Unicode whitespace URL validation bypass. When application code validates a user-supplied URL using WHATWG URL parsing (correctly rejecting protocol-relative paths), Angular's internal `resolveUrl` and `parseUrl` utilities subsequently call `String.prototype.trim()`, which strips leading Unicode characters such as U+00A0 (non-breaking space) or U+FEFF (BOM) that WHATWG parsing does not remove - transforming an apparently safe relative path into a protocol-relative URL pointing to the attacker's server. Applications using `relativeUrlsTransformerInterceptorFn` that attach Authorization or other credential headers to outbound HttpClient requests then dispatch those requests - including credentials - to the attacker's origin, resulting in SSRF and credential disclosure. No public exploit has been independently identified at time of analysis, though the patch commits effectively document the bypass technique.
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to 21.2.4) allows attackers to execute arbitrary commands on a developer's host when the developer hovers over and clicks a crafted JSDoc tooltip. The client trusts all rendered Markdown (isTrusted: true) while the language server fails to sanitize JSDoc content, enabling embedded command: URIs to fire from malicious source files or npm dependencies. No public exploit identified at time of analysis, but the supply-chain reach via npm packages makes this a notable developer-workstation risk.
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently run code on a developer's machine simply by having them open a malicious repository in VS Code. The extension reads the typescript.tsdk and js/ts.tsdk.path workspace settings without checking Workspace Trust, then require()s a tsserverlibrary.js file from that attacker-controlled path. No public exploit identified at time of analysis, though the patch diff in PR #68857 clearly illustrates the exploit primitive.
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the application's perceived origin by sending a request path like GET /\evil.com/, causing the server's URL parser to normalize the backslash and treat evil.com as the local origin. Affected Angular versions prior to 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8 that render via renderModule, renderApplication, or CommonEngine then redirect relative HttpClient calls and PlatformLocation.hostname-derived URLs to the attacker's domain, potentially exposing internal APIs or cloud metadata services. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile) and it is not in CISA KEV, though a vendor patch and a documented middleware workaround are available.
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute in the application origin when a poisoned translation file is merged into an app. The flaw affects Angular versions before 21.2.0, 21.1.16, 20.3.17, and 19.2.19, where HTML inside ICU (International Components for Unicode) messages from translated content was not sanitized before rendering. Exploitation is not open to arbitrary users - it requires first compromising a translation file (xliff, xtb, etc.), so this is effectively a supply-chain/third-party-translation risk; EPSS is very low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized href and xlink:href attributes on SVG <script> elements bound to untrusted data. Affects Angular versions prior to 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, with no public exploit identified at time of analysis despite a very low EPSS score of 0.01%. Patched releases are available from the Angular project, and exploitation requires the victim application to dynamically bind user-controlled values to those specific SVG script attributes.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hierarchical HttpClient is misconfigured with withRequestsMadeViaParent and SSR HTML is shared via a CDN or reverse proxy. The child injector's TransferCache evaluates each request before delegating it to the parent interceptor chain, so it sees the request as anonymous and stores the private authenticated response in the ng-state script tag serialized in the rendered HTML. Versions 20.x through 22.x are affected; no public exploit code has been identified at time of analysis.
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.2.20, and 22.1.0 allows unauthenticated remote attackers (with user interaction) to execute arbitrary JavaScript by bypassing built-in sanitization for security-sensitive host bindings. The compiler incorrectly derived SecurityContext from the declaring directive's CSS selector rather than the actual concrete host element, causing it to emit the wrong sanitizer-or no sanitizer at all-for attributes such as href, src, action, xlink:href, and data. Vendor-released patches exist for all three active release lines; no public exploit or KEV listing has been identified at time of analysis.
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and `X-Forwarded-*` family to determine the application's base origin without any validation of the dest...
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash. When an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` hea...
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" is the main product. The vulnerability is in Angular Template Compiler. So "Angular" is sufficient as a single product name. But could also say "Angular Framework" but 1-3 words: "Angular" fits. Summary: Must be original, not paraphrase description. Start with impact verb and product: "Stored Cross-Site Scripting in Angular Template Compiler versions 19.x prior to 19.2.17, 20.x prior to 20.3.15, 21.x prior to 21.0.2, and 18.x and earlier allows..." include that attacker can inject malicious scripts. Mention EPSS low, KEV not mentioned (so not in KEV), but POC? No explicit POC mention, but there is source code evidence, so likely not public exploit. "no public exploit identified at time of analysis". EPSS 0.04% low. Active exploitation? Not in KEV, but source code suggests a fix, and advisory from GitHub. No indication of active exploitation. So summary: "Stored Cross-Site Scripting (XSS) vulnerability in Angular's template compiler allows attackers to inject malicious JavaScript via specific URL-holding attributes and SVG animation elements, bypassing built-in sanitization." I'll craft more specifically. Technical context: CWE-79, the underlying technology is Angular's template compiler and its security schema for sanitization of attribute bindings. Mention that the compiler's incomplete schema for URL-holding attributes (like xlink:href, math:href) and SVG animation attribute "attributeName" leads to bypassing sanitization. CPE strings show angular for node.js. The commit diff shows changes to validation functions (e.g., replacing validateIframeAttribute with validateAttribute, adding new test cases for SVG animation). So root cause is insufficient classification of attributes as requiring URL security context. Risk assessment: Use CVSS vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X... So vector: AV:N network,
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript execution in end-user browsers when untrusted input is serialized inside template content nested within fallback raw-content elements (noscript, iframe, noembed, noframes) on versions prior to 20.3.30, 21.2.22, and 22.1.4. The root cause is a traversal bug in Angular's Domino serializer: the ancestor-tag walk that determines whether closing tags must be escaped stopped at DocumentFragment boundaries (the type returned by template.content), so unescaped closing tags could break out of their container and activate attacker-controlled markup when the browser's HTML5 RAWTEXT parser processes the server-rendered HTML. No public exploit or CISA KEV listing exists at time of analysis, but the Renderer2 imperative DOM construction path is unconditionally exploitable in all affected versions regardless of schema configuration.
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript execution in a victim's browser when attacker-controlled data reaches a `ProcessingInstruction` DOM node serialized inside an HTML5 RAWTEXT fallback container. Affected Angular versions prior to 20.3.30, 21.2.22, and 22.1.4 use a `domino` library build that escapes `>` in ProcessingInstruction data but not `<`, permitting a crafted closing tag such as `</noscript>` to prematurely terminate the RAWTEXT container and cause sibling elements to render as live HTML. The vulnerability is confirmed by GitHub Security Advisory GHSA-j3r3-mxqp-r2p4 with patches released across all three active Angular major release lines; no public exploit or CISA KEV listing exists at time of analysis.
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins via a Unicode whitespace URL validation bypass. When application code validates a user-supplied URL using WHATWG URL parsing (correctly rejecting protocol-relative paths), Angular's internal `resolveUrl` and `parseUrl` utilities subsequently call `String.prototype.trim()`, which strips leading Unicode characters such as U+00A0 (non-breaking space) or U+FEFF (BOM) that WHATWG parsing does not remove - transforming an apparently safe relative path into a protocol-relative URL pointing to the attacker's server. Applications using `relativeUrlsTransformerInterceptorFn` that attach Authorization or other credential headers to outbound HttpClient requests then dispatch those requests - including credentials - to the attacker's origin, resulting in SSRF and credential disclosure. No public exploit has been independently identified at time of analysis, though the patch commits effectively document the bypass technique.
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to 21.2.4) allows attackers to execute arbitrary commands on a developer's host when the developer hovers over and clicks a crafted JSDoc tooltip. The client trusts all rendered Markdown (isTrusted: true) while the language server fails to sanitize JSDoc content, enabling embedded command: URIs to fire from malicious source files or npm dependencies. No public exploit identified at time of analysis, but the supply-chain reach via npm packages makes this a notable developer-workstation risk.
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently run code on a developer's machine simply by having them open a malicious repository in VS Code. The extension reads the typescript.tsdk and js/ts.tsdk.path workspace settings without checking Workspace Trust, then require()s a tsserverlibrary.js file from that attacker-controlled path. No public exploit identified at time of analysis, though the patch diff in PR #68857 clearly illustrates the exploit primitive.
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the application's perceived origin by sending a request path like GET /\evil.com/, causing the server's URL parser to normalize the backslash and treat evil.com as the local origin. Affected Angular versions prior to 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8 that render via renderModule, renderApplication, or CommonEngine then redirect relative HttpClient calls and PlatformLocation.hostname-derived URLs to the attacker's domain, potentially exposing internal APIs or cloud metadata services. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile) and it is not in CISA KEV, though a vendor patch and a documented middleware workaround are available.
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute in the application origin when a poisoned translation file is merged into an app. The flaw affects Angular versions before 21.2.0, 21.1.16, 20.3.17, and 19.2.19, where HTML inside ICU (International Components for Unicode) messages from translated content was not sanitized before rendering. Exploitation is not open to arbitrary users - it requires first compromising a translation file (xliff, xtb, etc.), so this is effectively a supply-chain/third-party-translation risk; EPSS is very low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized href and xlink:href attributes on SVG <script> elements bound to untrusted data. Affects Angular versions prior to 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, with no public exploit identified at time of analysis despite a very low EPSS score of 0.01%. Patched releases are available from the Angular project, and exploitation requires the victim application to dynamically bind user-controlled values to those specific SVG script attributes.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hierarchical HttpClient is misconfigured with withRequestsMadeViaParent and SSR HTML is shared via a CDN or reverse proxy. The child injector's TransferCache evaluates each request before delegating it to the parent interceptor chain, so it sees the request as anonymous and stores the private authenticated response in the ng-state script tag serialized in the rendered HTML. Versions 20.x through 22.x are affected; no public exploit code has been identified at time of analysis.
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.2.20, and 22.1.0 allows unauthenticated remote attackers (with user interaction) to execute arbitrary JavaScript by bypassing built-in sanitization for security-sensitive host bindings. The compiler incorrectly derived SecurityContext from the declaring directive's CSS selector rather than the actual concrete host element, causing it to emit the wrong sanitizer-or no sanitizer at all-for attributes such as href, src, action, xlink:href, and data. Vendor-released patches exist for all three active release lines; no public exploit or KEV listing has been identified at time of analysis.
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and `X-Forwarded-*` family to determine the application's base origin without any validation of the dest...
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash. When an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` hea...
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" is the main product. The vulnerability is in Angular Template Compiler. So "Angular" is sufficient as a single product name. But could also say "Angular Framework" but 1-3 words: "Angular" fits. Summary: Must be original, not paraphrase description. Start with impact verb and product: "Stored Cross-Site Scripting in Angular Template Compiler versions 19.x prior to 19.2.17, 20.x prior to 20.3.15, 21.x prior to 21.0.2, and 18.x and earlier allows..." include that attacker can inject malicious scripts. Mention EPSS low, KEV not mentioned (so not in KEV), but POC? No explicit POC mention, but there is source code evidence, so likely not public exploit. "no public exploit identified at time of analysis". EPSS 0.04% low. Active exploitation? Not in KEV, but source code suggests a fix, and advisory from GitHub. No indication of active exploitation. So summary: "Stored Cross-Site Scripting (XSS) vulnerability in Angular's template compiler allows attackers to inject malicious JavaScript via specific URL-holding attributes and SVG animation elements, bypassing built-in sanitization." I'll craft more specifically. Technical context: CWE-79, the underlying technology is Angular's template compiler and its security schema for sanitization of attribute bindings. Mention that the compiler's incomplete schema for URL-holding attributes (like xlink:href, math:href) and SVG animation attribute "attributeName" leads to bypassing sanitization. CPE strings show angular for node.js. The commit diff shows changes to validation functions (e.g., replacing validateIframeAttribute with validateAttribute, adding new test cases for SVG animation). So root cause is insufficient classification of attributes as requiring URL security context. Risk assessment: Use CVSS vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X... So vector: AV:N network,
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.