Skip to main content
cve.nowby Sazabi
← npm
npmPackage

angular

13 known vulnerabilities (3 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release
1.8.3 (Apr 7, 2022): affected by 10 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
13 · 3 high, 8 medium
Weekly downloads
651.3K
Dependents
2,807
Releases
144 since 0.0.1 (Mar 28, 2012)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

  • AngularJS XSS via SCE resource URL sanitization bypass

    Affected: from 1.2.0-rc.3; from 1.2.0-rc.3, through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    >99.9% of angular downloads last week were affected versions (872K).

  • CVE-2025-0716Medium 4.8

    AngularJS improper sanitization in SVG '<image>' element

    Affected: all versions; through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    100% of angular downloads last week were affected versions (872.6K).

  • CVE-2024-8373Medium 4.8

    AngularJS improper sanitization in '<source>' element

    Affected: all versions; through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    100% of angular downloads last week were affected versions (872.6K).

  • CVE-2024-8372Medium 4.8

    AngularJS improper sanitization in 'srcset' attribute

    Affected: from 1.3.0-rc.4; from 1.3.0-rc.4, through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    98% of angular downloads last week were affected versions (856.2K).

  • This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.

    Affected: from 1.3.0, through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    98% of angular downloads last week were affected versions (856.2K).

  • CVE-2023-26116Medium 5.3

    Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility…

    Affected: through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    100% of angular downloads last week were affected versions (872.6K).

  • CVE-2023-26118Medium 5.3

    Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url">…

    Affected: through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    100% of angular downloads last week were affected versions (872.6K).

  • CVE-2023-26117Medium 5.3

    Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to…

    Affected: through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    100% of angular downloads last week were affected versions (872.6K).

  • CVE-2022-25869Medium 4.2

    All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to…

    Affected: through 1.8.3.

    No fix released. The latest release, 1.8.3, is still affected.

    100% of angular downloads last week were affected versions (872.6K).

  • CVE-2022-25844Medium 5.3

    Regular Expression Denial of Service (ReDoS)

    Affected: from 1.7.0.

    No fix released. The latest release, 1.8.3, is still affected.

    57% of angular downloads last week were affected versions (498.7K).

  • angular.js prior to 1.8.0 allows cross site scripting.

    Affected: fixed in 1.8.0.

    Fixed in 1.8.0 (released Jun 4, 2020, 4 days before disclosure).

    The latest release, 1.8.3, is not affected.

    51% of angular downloads last week were affected versions (444K).

  • There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web…

    Affected: fixed in 1.5.0-beta.1.

    Fixed in 1.5.0 (released Feb 5, 2016, 1427 days before disclosure, the advisory names 1.5.0-beta.1, which was never published).

    The latest release, 1.8.3, is not affected.

    10% of angular downloads last week were affected versions (90.3K).

  • In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a…

    Affected: fixed in 1.7.9.

    Fixed in 1.7.9 (released Nov 19, 2019, the day of disclosure).

    The latest release, 1.8.3, is not affected.

    46% of angular downloads last week were affected versions (403.7K).