Description
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | AngularJS | All versions prior to version 1.7.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | angular.js | 1.7.9-1 | — |
| Debian 12 | angular.js | 1.7.9-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | angular.js | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | XStatic-Angular-common +2 | 1:1.5.8.0-15.el9ost | RHSA-2023:0274 |
| Red Hat OpenStack 16 | XStatic-Angular-common +2 | 1:1.5.8.0-13.el8ost | RHSA-2022:8866, RHSA-2022:8849 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | angular | < 1.7.9 | 1.7.9 | GHSA-89mq-4x47-5v83 |
Advisories 5
- RHSA-2023:0274 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-XStatic-Angular) security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:8849 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:8866 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-0206 Red Hat OpenStack (AngularJS): Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Sep 23, 2024
- ICSA-20-133-02 OSIsoft PI System (Update A) CISA ICS & IT advisories · Jun 9, 2020