Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 20.3.28, 21.2.20, 22.1.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- angular angular
through 19.2.25; From 20.0.0 · fixed in 20.3.28; From 21.0.0 · fixed in 21.2.20; From 22.0.0 · fixed in 22.1.0
- @angular/corenpm
From 22.0.0 · fixed in 22.1.0
- @angular/compilernpm
From 22.0.0 · fixed in 22.1.0
- @angular/corenpm
From 21.0.0 · fixed in 21.2.20
- @angular/compilernpm
From 21.0.0 · fixed in 21.2.20
- @angular/corenpm
From 20.0.0 · fixed in 20.3.28
- @angular/compilernpm
From 20.0.0 · fixed in 20.3.28
- @angular/corenpm
through 19.2.25
- @angular/compilernpm
through 19.2.25