GitHub Advisoryadvisory · npm

GHSA-qwqh-hm9m-p5hr angular vulnerable to regular expression denial of service via the <input type="url"> element

MEDIUM Published 2023-03-30 Modified 2025-11-03 Official page ↗
Aliases
CVE-2023-26118
Ecosystem
npm
Packages
angular
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333
Reviewed
2023-04-03

Affected packages

• npm angular: <= 1.8.3 (no fix yet)

Description

All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Related

Alias · CVE (1)

  • CVE-2023-26118 Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url">… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References