angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend

Description

angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.

Recommendation

Update the angular-server-side-configuration package to the latest compatible version. Followings are version details:

• Affected version(s): >= 15.0.0, < 15.1.0
• Patched version(s): 15.1.0

References

• GHSA-gwvm-vrp4-4pp5
• CVE-2023-28444
• CWE-200
• CWE-538
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6