angular vulnerabilities

HTML enhanced for web apps

Registry
npm
Latest
1.8.3
License
MIT
Source
github.com/angular/angular.js (opens the source repository in a new tab)

15 known advisories

The latest version, 1.8.3, is affected by 10 of them.

Security advisories for angular

  • HighGHSA-7x27-g8rg-x87w24 Jun 2026

    Angular's deprecated package has a Cross-Site Scripting issue

    Affected
    >=1.2.0-rc.3 <=1.8.3
    Fixed in
    No fix released
  • LowGHSA-j58c-ww9w-pwp529 Apr 2025

    AngularJS improperly sanitizes SVG elements

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • LowGHSA-m9gf-397r-hwpg9 Sept 2024

    AngularJS allows attackers to bypass common image source restrictions

    Affected
    >=1.3.0-rc.4 <=1.8.3
    Fixed in
    No fix released
  • LowGHSA-mqm9-c95h-x2p69 Sept 2024

    AngularJS allows attackers to bypass common image source restrictions

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • HighGHSA-4w4v-5hc9-xrr210 Feb 2024

    angular vulnerable to super-linear runtime due to backtracking

    Affected
    >=1.3.0 <=1.8.3
    Fixed in
    No fix released
  • MediumGHSA-2qqx-w9hr-q5gx30 Mar 2023

    angular vulnerable to regular expression denial of service via the $resource service

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumGHSA-2vrf-hf26-jrp530 Mar 2023

    angular vulnerable to regular expression denial of service via the angular.copy() utility

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumGHSA-qwqh-hm9m-p5hr30 Mar 2023

    angular vulnerable to regular expression denial of service via the <input type="url"> element

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumGHSA-prc3-vjfx-vhm916 Jul 2022

    Angular (deprecated package) Cross-site Scripting

    Affected
    <=1.8.3
    Fixed in
    No fix released
  • MediumGHSA-m2h2-264f-f4863 May 2022

    angular vulnerable to regular expression denial of service (ReDoS)

    Affected
    >=1.7.0
    Fixed in
    No fix released
  • MediumGHSA-5cp4-xmrw-59wf5 Aug 2020

    XSS via JQLite DOM manipulation functions in AngularJS

    Affected
    <1.8.0
    Fixed in
    1.8.0
  • MediumGHSA-mhp6-pxh8-r67518 Jun 2020

    Angular vulnerable to Cross-site Scripting

    Affected
    <1.8.0
    Fixed in
    1.8.0
  • MediumGHSA-r5fx-8r73-v86c14 Feb 2020

    AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

    Affected
    <1.5.0-beta.1
    Fixed in
    1.5.0-beta.1
  • HighGHSA-89mq-4x47-5v8320 Nov 2019

    angular Prototype Pollution vulnerability

    Affected
    <1.7.9
    Fixed in
    1.7.9
  • MediumGHSA-28hp-fgcr-2r4h27 Jun 2019

    Cross-Site Scripting via JSONP

    Affected
    <1.6.0
    Fixed in
    1.6.0

Which of your client projects still run an old angular?

NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other npm packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.