MediumGHSA-r5fx-8r73-v86cCVE-2019-14863
AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes
Published 14 Feb 2020 · Updated 20 Nov 2025
Affected package
angularnpm
- Affected
- <1.5.0-beta.1
- Fixed in
- 1.5.0-beta.1
Update to the fixed version for your release line, for example:
npm install angular@1.5.0-beta.1Details
Versions of angular prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize xlink:href attributes, which may allow attackers to execute arbitrary JavaScript in a victim's browser if the value is user-controlled.
Recommendation
Upgrade to version 1.5.0-beta.1 or later.
Is GHSA-r5fx-8r73-v86c in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected angular, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2019-14863
- Linkgithub.com/angular/angular.js/pull/12524
- Linkgithub.com/angular/angular.js/commit/35a21532b73d5bd84b4325211c563e6a3e2dde82
- Linkgithub.com/angular/angular.js/commit/f33ce173c90736e349cf594df717ae3ee41e0f7a
- Linkbugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863
- Packagegithub.com/angular/angular.js
- Linksnyk.io/vuln/npm:angular:20150807
- Linkwww.npmjs.com/advisories/1453
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.