AngularJS allows attackers to bypass common image source restrictions
Published 9 Sept 2024 · Updated 10 Sept 2026
Affected package
- Affected
- <=1.8.3
- Fixed in
- No fix released
Details
Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects all versions of AngularJS.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Is GHSA-mqm9-c95h-x2p6 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected angular, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-8373
- Linkcodepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b
- Packagegithub.com/angular/angular.js
- Linklists.debian.org/debian-lts-announce/2025/07/msg00005.html
- Linksecurity.netapp.com/advisory/ntap-20241122-0003
- Linkwww.herodevs.com/vulnerability-directory/cve-2024-8373
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.