GitHub Advisoryadvisory · npm

GHSA-mhp6-pxh8-r675 Angular vulnerable to Cross-site Scripting

MEDIUM Published 2020-06-18 Modified 2025-11-20 Official page ↗
Aliases
CVE-2020-7676
Ecosystem
npm
Packages
angular
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-18

Affected packages

• npm angular: < 1.8.0 → fixed in 1.8.0

Description

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping `` elements in `` ones changes parsing behavior, leading to possibly unsanitizing code.

Related

Alias · CVE (1)

  • CVE-2020-7676 angular.js prior to 1.8.0 allows cross site scripting. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References