Description
All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
NPM package angular is deprecated. Those who want to receive security updates should use the actively maintained package @angular/core.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.8.3
References
Could your website be exposed too?
SmartScanner can check your website for Angular (deprecated package) Cross-site Scripting and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Angular's deprecated package has a Cross-Site Scripting issue - CVE-2026-11998
- angular-ui-notification Cross-site Scripting vulnerability - CVE-2023-34840
- CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-markdown-gfm - CVE-2022-31175
- CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-html-support - CVE-2022-31175
You might also like:
See something that needs correcting? Let us knowUpdated July 28, 2025