XSS via JQLite DOM manipulation functions in AngularJS

Description

XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.

Recommendation

Update the angular package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.8.0
• Patched version(s): 1.8.0

References

• GHSA-5cp4-xmrw-59wf
• blog.jquery.com
• snyk.io
• CWE-79
• OWASP 2021-A3

Related Issues

• CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
• @tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Ori - Vulnerability
• TeleJSON: DOM XSS via unsanitised constructor name in `new Function()` - CVE-2026-47099
• Svelte: SSR XSS via Insecure Promise Serialization in hydratable - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

angular