AngularJS allows attackers to bypass common image source restrictions
Published 9 Sept 2024 · Updated 10 Sept 2026
Affected package
- Affected
- >=1.3.0-rc.4 <=1.8.3
- Fixed in
- No fix released
Details
Improper sanitization of the value of the [srcset] attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects AngularJS versions 1.3.0-rc.4 and greater.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Is GHSA-m9gf-397r-hwpg in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected angular, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-8372
- Linkcodepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017
- Packagegithub.com/angular/angular.js
- Linklists.debian.org/debian-lts-announce/2025/07/msg00005.html
- Linksecurity.netapp.com/advisory/ntap-20241122-0002
- Linkwww.herodevs.com/vulnerability-directory/cve-2024-8372
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.