GHSA-r5fx-8r73-v86cMediumCVSS 6.1

AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

Published
February 14, 2020
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2019-14863 →

📋 Description

Versions of angular prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize xlink:href attributes, which may allow attackers to execute arbitrary JavaScript in a victim's browser if the value is user-controlled.

Recommendation

Upgrade to version 1.5.0-beta.1 or later.

🎯 Affected products1

  • npm/angular:< 1.5.0-beta.1

🔗 References (8)