@angular/core vulnerabilities
Angular - the core framework
- Registry
- npm
- Latest
- 22.2.3
- License
- MIT
9 known advisories
The latest version, 22.2.3, is not affected by any of them. Projects on older versions may be.
npm install @angular/core@22.2.3Security advisories for @angular/core
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
- Affected
- >=22.0.0 <22.1.0 · >=21.0.0 <21.2.20 · >=20.0.0 <20.3.28 · <=19.2.25
- Fixed in
- 20.3.28, 21.2.20, 22.1.0
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.19 · >=20.0.0-next.0 <20.3.27 · <=19.2.25
- Fixed in
- 20.3.27, 21.2.19, 22.0.1
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
- Affected
- >=21.0.0-next.0 <21.2.15 · >=22.0.0-next.0 <22.0.0-rc.2 · >=20.0.0-next.0 <20.3.22 · >=19.0.0-next.0 <19.2.22 · <=18.2.14
- Fixed in
- 19.2.22, 20.3.22, 21.2.15, 22.0.0-rc.2
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
- Affected
- >=21.0.0-next.0 <21.2.15 · >=22.0.0-next.0 <22.0.0-rc.2 · >=19.0.0-next.0 <19.2.23 · <=18.2.14 · >=20.0.0-next.0 <20.3.22
- Fixed in
- 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
Angular vulnerable to XSS in i18n attribute bindings
- Affected
- >=22.0.0-next.0 <22.0.0-next.3 · >=21.0.0-next.0 <21.2.4 · >=20.0.0-next.0.0.0 <20.3.18 · >=19.0.0-next.0 <19.2.20 · >=17.0.0-next.0 <=18.2.14
- Fixed in
- 19.2.20, 20.3.18, 21.2.4, 22.0.0-next.3
Angular i18n vulnerable to Cross-Site Scripting
- Affected
- >=21.2.0-next.0 <21.2.0 · >=21.0.0-next.0 <21.1.6 · >=20.0.0-next.0 <20.3.17 · >=19.0.0-next.0 <19.2.19 · <=18.2.14
- Fixed in
- 19.2.19, 20.3.17, 21.1.6, 21.2.0
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
- Affected
- >=21.1.0-next.0 <21.1.0-rc.0 · >=21.0.0-next.0 <21.0.7 · >=20.0.0-next.0 <20.3.16 · >=19.0.0-next.0 <19.2.18 · <=18.2.14
- Fixed in
- 19.2.18, 20.3.16, 21.0.7, 21.1.0-rc.0
Angular vulnerable to Cross-site Scripting
- Affected
- >=11.0.0 <11.0.5 · >=11.1.0-next.0 <11.1.0-next.3 · <10.2.5
- Fixed in
- 10.2.5, 11.0.5, 11.1.0-next.3
Which of your client projects still run an old @angular/core?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.