Skip to content
OpenAdvisories

Package · npm

angular

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.6
    CVE-2026-11998

    AngularJS XSS via SCE resource URL sanitization bypass

    A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted…

    Google AngularJS angular.js angular.js Debian Ubuntu npm
  • High 7.5
    CVE-2024-21490 Public exploit

    angular vulnerable to super-linear runtime due to backtracking

    This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-craf…

    angular.js angular.js angular org.webjars.npm:angular Debian Ubuntu npm Maven
  • High 7.1
    CVE-2019-14863

    AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

    There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

    Red Hat angular: angular.js angular.js Debian Ubuntu npm
  • High 7.5
    CVE-2019-10768

    angular Prototype Pollution vulnerability

    In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.

    angular.js angular.js angular Debian Ubuntu npm