Description
XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.
Recommendation
Update the angular package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.8.0
- Patched version(s): 1.8.0
References
Could your website be exposed too?
SmartScanner can check your website for XSS via JQLite DOM manipulation functions in AngularJS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF - CVE-2025-65959
- wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
- Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE - CVE-2025-64495
- i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes - CVE-2026-41692
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023