AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

Description

Versions of angular prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize xlink:href attributes, which may allow attackers to execute arbitrary JavaScript in a victim’s browser if the value is user-controlled.

Recommendation

Update the angular package to the latest compatible version. Followings are version details:

Affected version(s): < 1.5.0-beta.1
Patched version(s): 1.5.0-beta.1

References

GHSA-r5fx-8r73-v86c
bugzilla.redhat.com
snyk.io
www.npmjs.com
CVE-2019-14863
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes and gives you actionable findings to investigate.

Start a free scan

Related Issues

Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript - CVE-2019-16763
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
Angular (deprecated package) Cross-site Scripting - CVE-2022-25869
angular-ui-notification Cross-site Scripting vulnerability - CVE-2023-34840

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated January 27, 2023