Vulnerabilities

 14 via 14 paths

Dependencies

 88

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 6
  • 5
  • 2
Status
  • 14
  • 0
  • 0

critical severity
new

Use of Weak Hash

  • Vulnerable module: @angular/common
  • Introduced through: @angular/common@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/common@21.2.8
    Remediation: Upgrade to @angular/common@21.2.17.

Overview

Affected versions of this package are vulnerable to Use of Weak Hash due to the use of a weak 32-bit hash in the HttpTransferCache. When a victim visits a crafted link containing the colliding parameter, the SSR process executes both the search request and the profile request. Due to the hash collision, the search response overwrites the profile response in the TransferState cache.

Workaround

This vulnerability can be mitigated by configuring HTTP requests to skip transfer caching for sensitive endpoints or by disabling the HTTP transfer cache globally in the application bootstrap configuration.

Remediation

Upgrade @angular/common to version 20.3.25, 21.2.17, 22.0.1 or higher.

References

Use of Weak Hash vulnerability report

high severity

Server-side Request Forgery (SSRF)

  • Vulnerable module: @angular/platform-server
  • Introduced through: @angular/platform-server@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/platform-server@21.2.8
    Remediation: Upgrade to @angular/platform-server@21.2.13.

Overview

@angular/platform-server is an Angular - library for using Angular in Node.js

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the processing of absolute-form URLs in the server-side rendering engine. An attacker can redirect internal HTTP requests to an attacker-controlled server by supplying a crafted request URL, potentially exposing sensitive internal APIs or metadata services.

Workaround

This vulnerability can be mitigated by implementing strict URL validation in the server entry point to ensure that incoming request URLs are validated against a known list of trusted hostnames or normalized to a relative path before being passed to the rendering functions.

Remediation

Upgrade @angular/platform-server to version 19.2.22, 20.3.21, 21.2.13, 22.0.0-next.12 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

high severity
new

Modification of Assumed-Immutable Data

  • Vulnerable module: @angular/core
  • Introduced through: @angular/core@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/core@21.2.8
    Remediation: Upgrade to @angular/core@21.2.17.

Overview

@angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data via document.getElementById('ng-state'), during client-side SSR hydration, which enables DOM clobbering. An attacker can inject malicious JSON payloads into the application's TransferState cache by introducing a DOM element with a predictable identifier before the legitimate state script is parsed, causing forged API responses to be served to users and leading to the execution of arbitrary scripts, privilege escalation, or UI manipulation.

Workaround

This vulnerability can be mitigated by sanitizing or prefixing dynamic IDs to prevent user-controlled values from being used directly, or by configuring a unique, non-predictable application ID to change the state element's identifier.

Remediation

Upgrade @angular/core to version 20.3.25, 21.2.17, 22.0.1 or higher.

References

Modification of Assumed-Immutable Data vulnerability report

high severity
new

Server-side Request Forgery (SSRF)

  • Vulnerable module: @angular/platform-server
  • Introduced through: @angular/platform-server@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/platform-server@21.2.8
    Remediation: Upgrade to @angular/platform-server@21.2.15.

Overview

@angular/platform-server is an Angular - library for using Angular in Node.js

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parser used to initialize the server emulated DOM. An attacker can redirect server-side outgoing requests to arbitrary external endpoints and potentially inject malicious content into the rendered HTML by sending specially crafted HTTP requests with malformed Host headers or absolute-form request URIs.

Note: This is only exploitable if the application is configured for server-side rendering, reconstructs request URLs from raw client inputs, performs outbound backend API requests using relative paths, and has the allowedHosts option enabled.

Remediation

Upgrade @angular/platform-server to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

high severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: @angular/common
  • Introduced through: @angular/common@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/common@21.2.8
    Remediation: Upgrade to @angular/common@21.2.15.

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the formatNumber function when the digitsInfo parameter is controlled by untrusted user input. An attacker can exhaust system resources and cause application unavailability by supplying a specially crafted digitsInfo string with excessively large fraction digit values.

Note: This is only exploitable if the application uses number formatting utilities and allows untrusted input to control the digitsInfo parameter.

Remediation

Upgrade @angular/common to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity
new

Regular Expression Denial of Service (ReDoS)

  • Vulnerable module: @angular/common
  • Introduced through: @angular/common@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/common@21.2.8
    Remediation: Upgrade to @angular/common@21.2.17.

Overview

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the formatDate function when processing an excessively long or attacker-controlled date format string. An attacker can cause high CPU and memory consumption, leading to application unavailability or browser unresponsiveness by supplying a maliciously crafted format string.

Note: This is only exploitable if the application formats dates using the vulnerable utility or pipe and the format string is customizable or controlled by untrusted user input.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade @angular/common to version 20.3.25, 21.2.17, 22.0.1 or higher.

References

Regular Expression Denial of Service (ReDoS) vulnerability report

high severity
new

Cross-site Scripting (XSS)

  • Vulnerable module: @angular/compiler
  • Introduced through: @angular/compiler@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/compiler@21.2.8
    Remediation: Upgrade to @angular/compiler@21.2.17.

Overview

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the two-way property binding. An attacker can execute arbitrary JavaScript in the context of the user's browser by supplying crafted input to a sensitive DOM property bound with two-way binding syntax.

Note: This is only exploitable if the application uses two-way binding on a sensitive native DOM property, the bound value is user-controllable, and no additional manual sanitization is performed.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Type Origin Description
Stored Server The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected Server The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based Client The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

  • Web servers
  • Application servers
  • Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

  • Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
  • Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
  • Give users the option to disable client-side scripts.
  • Redirect invalid requests.
  • Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
  • Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
  • Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/compiler to version 20.3.25, 21.2.17, 22.0.1 or higher.

References

Cross-site Scripting (XSS) vulnerability report

medium severity
new

Cross-site Scripting (XSS)

  • Vulnerable module: @angular/compiler
  • Introduced through: @angular/compiler@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/compiler@21.2.8
    Remediation: Upgrade to @angular/compiler@21.2.15.

Overview

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper handling of namespaced elements and attributes during template compilation and sanitization. An attacker can execute arbitrary JavaScript in the user's browser by injecting specially crafted templates or tag structures with custom namespaces that bypass script-stripping logic and attribute sanitizers.

Note: This is only exploitable if the application accepts user-controlled template input, supports namespace parsing in templates, and does not perform additional input sanitization before processing with the template compiler.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Type Origin Description
Stored Server The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected Server The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based Client The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

  • Web servers
  • Application servers
  • Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

  • Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
  • Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
  • Give users the option to disable client-side scripts.
  • Redirect invalid requests.
  • Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
  • Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
  • Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/compiler to version 19.2.18, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.

References

Cross-site Scripting (XSS) vulnerability report

medium severity
new

Cross-site Scripting (XSS)

  • Vulnerable module: @angular/core
  • Introduced through: @angular/core@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/core@21.2.8
    Remediation: Upgrade to @angular/core@21.2.15.

Overview

@angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper handling of namespaced elements and attributes during template compilation and sanitization. An attacker can execute arbitrary JavaScript in the user's browser by injecting specially crafted templates or tag structures with custom namespaces that bypass script-stripping logic and attribute sanitizers.

Note: This is only exploitable if the application accepts user-controlled template input, supports namespace parsing in templates, and does not perform additional input sanitization before processing with the template compiler.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Type Origin Description
Stored Server The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected Server The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based Client The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

  • Web servers
  • Application servers
  • Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

  • Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
  • Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
  • Give users the option to disable client-side scripts.
  • Redirect invalid requests.
  • Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
  • Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
  • Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/core to version 19.2.18, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.

References

Cross-site Scripting (XSS) vulnerability report

medium severity

Server-side Request Forgery (SSRF)

  • Vulnerable module: @angular/platform-server
  • Introduced through: @angular/platform-server@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/platform-server@21.2.8
    Remediation: Upgrade to @angular/platform-server@21.2.9.

Overview

@angular/platform-server is an Angular - library for using Angular in Node.js

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the URL parsing during Server-Side Rendering (SSR). An attacker can cause the server to make arbitrary HTTP requests to attacker-controlled domains by sending specially crafted requests with protocol-relative or backslash-prefixed URLs. This can result in exposure of internal APIs or metadata services if the server performs HTTP requests using relative URLs or constructs URLs based on the manipulated origin.

Note:

Affected APIs (used with Angular SSR):

  • renderModule
  • renderApplication
  • CommonEngine

Workaround

This vulnerability can be mitigated by implementing middleware to sanitize incoming request URLs, ensuring they start with a single forward slash and removing any leading backslashes or multiple slashes.

Remediation

Upgrade @angular/platform-server to version 19.2.21, 20.3.19, 21.2.9, 22.0.0-next.8 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

medium severity

Open Redirect

  • Vulnerable module: @angular/ssr
  • Introduced through: @angular/ssr@21.2.7

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/ssr@21.2.7
    Remediation: Upgrade to @angular/ssr@21.2.9.

Overview

@angular/ssr is a the Angular server side rendering utilities.

Affected versions of this package are vulnerable to Open Redirect via improper handling of the X-Forwarded-Prefix header. An attacker can manipulate internal redirects or server-side requests by injecting encoded path traversal sequences, which are decoded and used by the application logic. This can result in unintended redirects or requests to internal or external endpoints.

Note: This is only exploitable if the application is configured to trust proxy headers and is deployed behind a proxy that forwards the X-Forwarded-Prefix header without prior sanitization.

Remediation

Upgrade @angular/ssr to version 19.2.25, 20.3.25, 21.2.9, 22.0.0-next.7 or higher.

References

Open Redirect vulnerability report

medium severity
new

Cross-site Scripting (XSS)

  • Vulnerable module: @angular/core
  • Introduced through: @angular/core@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/core@21.2.8
    Remediation: Upgrade to @angular/core@21.2.15.

Overview

@angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the createComponent mechanism. An attacker can execute arbitrary JavaScript code in the context of the user's browser by mounting a dynamic component onto a <script> or namespaced script element when user-controlled input is passed as the selector or host element and no additional input sanitization is performed.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Type Origin Description
Stored Server The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected Server The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based Client The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

  • Web servers
  • Application servers
  • Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

  • Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
  • Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
  • Give users the option to disable client-side scripts.
  • Redirect invalid requests.
  • Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
  • Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
  • Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/core to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.

References

Cross-site Scripting (XSS) vulnerability report

low severity
new

Use of Cache Containing Sensitive Information

  • Vulnerable module: @angular/common
  • Introduced through: @angular/common@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/common@21.2.8
    Remediation: Upgrade to @angular/common@21.2.15.

Overview

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the HttpTransferCache utility. An attacker can access sensitive user-specific information by making requests to pages that have been cached by a shared caching layer after another user has authenticated and triggered credentialed requests during server-side rendering.

Note: This is only exploitable if server-side rendering and hydration are enabled, credentialed HTTP requests are performed during SSR, and the SSR-rendered HTML is cached by a shared caching layer without proper cache-control headers to distinguish authenticated users.

Remediation

Upgrade @angular/common to version 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2 or higher.

References

Use of Cache Containing Sensitive Information vulnerability report

low severity
new

Directory Traversal

  • Vulnerable module: @babel/core
  • Introduced through: @angular/localize@21.2.8

Detailed paths

  • Introduced through: angularexampleapp@ismaestro/angular5-example-app › @angular/localize@21.2.8 › @babel/core@7.29.0

Overview

Affected versions of this package are vulnerable to Directory Traversal via the inputSourceMap function. An attacker can access arbitrary files by crafting malicious input source code containing a #sourceMappingURL comment that references a specific source map file path.

Note:

This is only exploitable if all these conditions are met: the attacker controls the input source code, can read the output source code, and knows the path of the source map file they want to read.

Workaround

This vulnerability can be mitigated by setting inputSourceMap: false in the Babel options or by manually extracting and validating the #sourceMappingURL comment before processing.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade @babel/core to version 7.29.6, 8.0.0-rc.6 or higher.

References

Directory Traversal vulnerability report