# angular (npm) vulnerabilities 13 known vulnerabilities (3 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.8.3 (Apr 7, 2022): affected by 10 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 651.3K - Dependents: 2,807 - Releases: 144 since 0.0.1 (Mar 28, 2012) - Registry: https://www.npmjs.com/package/angular - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-11998: 1.2.0 to 1.8.3 (through the newest release) - CVE-2025-0716: 0.0.1-1 to 1.8.3 (through the newest release) - CVE-2024-8373: 0.0.1-1 to 1.8.3 (through the newest release) - CVE-2024-8372: 1.3.0-rc.5 to 1.8.3 (through the newest release) - CVE-2024-21490: 1.3.0 to 1.8.3 (through the newest release) - CVE-2023-26116: 0.0.1-1 to 1.8.3 (through the newest release) - CVE-2023-26118: 0.0.1-1 to 1.8.3 (through the newest release) - CVE-2023-26117: 0.0.1-1 to 1.8.3 (through the newest release) - CVE-2022-25869: 0.0.1-1 to 1.8.3 (through the newest release) - CVE-2022-25844: 1.7.0 to 1.8.3 (through the newest release) - CVE-2020-7676: 0.0.1-1 to 1.7.9 (1.8.0 is outside it) - CVE-2019-14863: 0.0.1-1 to 1.5.0-beta.0 (1.5.0-beta.2 is outside it) - CVE-2019-10768: 0.0.1-1 to 1.7.8 (1.7.9 is outside it) ## Advisories (13) ### [CVE-2026-11998](https://cve.now/CVE-2026-11998): AngularJS XSS via SCE resource URL sanitization bypass - Severity: High 7.6 - Published: Jun 24, 2026 - Affected: from 1.2.0-rc.3; from 1.2.0-rc.3, through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - >99.9% of angular downloads last week were affected versions (872K). ### [CVE-2025-0716](https://cve.now/CVE-2025-0716): AngularJS improper sanitization in SVG '\' element - Severity: Medium 4.8 - Published: Apr 29, 2025 - Affected: all versions; through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 100% of angular downloads last week were affected versions (872.6K). ### [CVE-2024-8373](https://cve.now/CVE-2024-8373): AngularJS improper sanitization in '\' element - Severity: Medium 4.8 - Published: Sep 9, 2024 - Affected: all versions; through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 100% of angular downloads last week were affected versions (872.6K). ### [CVE-2024-8372](https://cve.now/CVE-2024-8372): AngularJS improper sanitization in 'srcset' attribute - Severity: Medium 4.8 - Published: Sep 9, 2024 - Affected: from 1.3.0-rc.4; from 1.3.0-rc.4, through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 98% of angular downloads last week were affected versions (856.2K). ### [CVE-2024-21490](https://cve.now/CVE-2024-21490): This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. - Severity: High 7.5 - Published: Feb 10, 2024 - Affected: from 1.3.0, through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 98% of angular downloads last week were affected versions (856.2K). ### [CVE-2023-26116](https://cve.now/CVE-2023-26116): Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility… - Severity: Medium 5.3 - Published: Mar 30, 2023 - Affected: through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 100% of angular downloads last week were affected versions (872.6K). ### [CVE-2023-26118](https://cve.now/CVE-2023-26118): Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the \… - Severity: Medium 5.3 - Published: Mar 30, 2023 - Affected: through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 100% of angular downloads last week were affected versions (872.6K). ### [CVE-2023-26117](https://cve.now/CVE-2023-26117): Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to… - Severity: Medium 5.3 - Published: Mar 30, 2023 - Affected: through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 100% of angular downloads last week were affected versions (872.6K). ### [CVE-2022-25869](https://cve.now/CVE-2022-25869): All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to… - Severity: Medium 4.2 - Published: Jul 15, 2022 - Affected: through 1.8.3. - No fix released. The latest release, 1.8.3, is still affected. - 100% of angular downloads last week were affected versions (872.6K). ### [CVE-2022-25844](https://cve.now/CVE-2022-25844): Regular Expression Denial of Service (ReDoS) - Severity: Medium 5.3 - Published: May 1, 2022 - Affected: from 1.7.0. - No fix released. The latest release, 1.8.3, is still affected. - 57% of angular downloads last week were affected versions (498.7K). ### [CVE-2020-7676](https://cve.now/CVE-2020-7676): angular.js prior to 1.8.0 allows cross site scripting. - Severity: Unrated - Published: Jun 8, 2020 - Affected: fixed in 1.8.0. - Fixed in 1.8.0 (released Jun 4, 2020, 4 days before disclosure). - The latest release, 1.8.3, is not affected. - 51% of angular downloads last week were affected versions (444K). ### [CVE-2019-14863](https://cve.now/CVE-2019-14863): There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web… - Severity: High 7.1 - Published: Jan 2, 2020 - Affected: fixed in 1.5.0-beta.1. - Fixed in 1.5.0 (released Feb 5, 2016, 1427 days before disclosure, the advisory names 1.5.0-beta.1, which was never published). - The latest release, 1.8.3, is not affected. - 10% of angular downloads last week were affected versions (90.3K). ### [CVE-2019-10768](https://cve.now/CVE-2019-10768): In AngularJS before 1.7.9 the function \`merge()\` could be tricked into adding or modifying properties of \`Object.prototype\` using a… - Severity: Unrated - Published: Nov 19, 2019 - Affected: fixed in 1.7.9. - Fixed in 1.7.9 (released Nov 19, 2019, the day of disclosure). - The latest release, 1.8.3, is not affected. - 46% of angular downloads last week were affected versions (403.7K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/angular Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.