angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend

Description

angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.

Recommendation

Update the angular-server-side-configuration package to the latest compatible version. Followings are version details:

• Affected version(s): >= 15.0.0, < 15.1.0
• Patched version(s): 15.1.0

References

• GHSA-gwvm-vrp4-4pp5
• CVE-2023-28444
• CWE-200
• CWE-538
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability - CVE-2023-48711
• HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability - CVE-2025-59155
• static-server Path Traversal vulnerability - CVE-2023-26152
• lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability - CVE-2024-32964

Tags:

npm

angular-server-side-configuration