Description
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | angular.js | All versions prior to 1.8.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | angular.js | 1.8.0-1 | — |
| Debian 12 | angular.js | 1.8.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | angular.js | No fix yet | — |
| Ubuntu Pro 18.04 LTS | angular.js | No fix yet | — |
| Ubuntu Pro 16.04 LTS | angular.js | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 9.0.12-1.redhat_00001.1.el6sso | RHSA-2021:0969, RHSA-2021:0968, RHSA-2021:0967 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | angular | < 1.8.0 | 1.8.0 | GHSA-mhp6-pxh8-r675 |
Advisories 3
- RHSA-2021:0969 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.6 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0967 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.6 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0968 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.6 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
References
- https://github.com/angular/angular.js/pull/17028%2C
- https://snyk.io/vuln/SNYK-JS-ANGULAR-570058
- [nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html mailing-list
- [hadoop-ozone-issues] 20201006 [jira] [Updated] (HDDS-4316) Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list
- [hadoop-ozone-issues] 20201006 [GitHub] [hadoop-ozone] vivekratnavel opened a new pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list
- [hadoop-ozone-issues] 20201006 [jira] [Created] (HDDS-4316) Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list
- [hadoop-ozone-issues] 20201006 [GitHub] [hadoop-ozone] dineshchitlangia commented on a change in pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list
- [hadoop-ozone-issues] 20201007 [GitHub] [hadoop-ozone] vivekratnavel commented on pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list
- [hadoop-ozone-issues] 20201008 [jira] [Updated] (HDDS-4316) Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list
- [hadoop-ozone-commits] 20201008 [hadoop-ozone] branch master updated: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 (#1481) mailing-list
- [hadoop-ozone-issues] 20201008 [GitHub] [hadoop-ozone] adoroszlai merged pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list
- [hadoop-ozone-issues] 20201009 [GitHub] [hadoop-ozone] adoroszlai merged pull request #1481: HDDS-4316. Upgrade to angular 1.8.0 due to CVE-2020-7676 mailing-list