Vulnerabilities

 1 via 1 paths

Dependencies

 88

Source

 GitHub

Commit

 16d9c6c3

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity
new

Insertion of Sensitive Information Into Sent Data

  • Vulnerable module: @angular/common
  • Introduced through: @angular/common@21.0.0

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app#16d9c6c3a10e2c2394ad80ad5f3b51cf2c55f804 › @angular/common@21.0.0
    Remediation: Upgrade to @angular/common@21.0.1.

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HttpClient which has a built-in XSRF protection mechanism. An attacker can obtain sensitive authentication tokens by crafting requests using protocol-relative URLs that cause the token to be sent to domains under the attacker's control.

Note: This is only exploitable if XSRF protection is enabled and the application allows requests to protocol-relative URLs.

Workaround

This vulnerability can be mitigated by avoiding the use of protocol-relative URLs (those starting with //) in requests and ensuring all backend communication URLs are either relative paths or fully qualified, trusted absolute URLs.

Remediation

Upgrade @angular/common to version 19.2.16, 20.3.14, 21.0.1 or higher.

References

Insertion of Sensitive Information Into Sent Data vulnerability report