What is GHSA-28hp-fgcr-2r4h?

GHSA-28hp-fgcr-2r4h is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting via JSONP

Why does GHSA-28hp-fgcr-2r4h have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-28hp-fgcr-2r4h?

GHSA-28hp-fgcr-2r4h affects 1 product, including: npm/angular:\u003c 1.6.0.

GHSA-28hp-fgcr-2r4hMediumDisclosed before NVD

Cross-Site Scripting via JSONP

Vendor

GitHub Security Advisories

Published

June 27, 2019

Last Modified

January 9, 2023

📋 Description

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.

🎯 Affected products1

npm/angular:< 1.6.0

🔗 References (3)

https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4
https://www.npmjs.com/advisories/1630
https://github.com/advisories/GHSA-28hp-fgcr-2r4h