Executive brief
Angular Universal is a server-side rendering framework for Angular applications. Versions 16.1.0 and 16.1.1 contain a cross-site scripting (XSS) vulnerability in their critical CSS inlining feature that allows attackers to inject malicious JavaScript code into web pages, potentially compromising user sessions or stealing sensitive data.
Technical details
The vulnerability is a reflected/stored XSS (CWE-79, CWE-116) in Angular Universal's critical CSS inlining feature, affecting versions 16.1.0–16.1.1. The root cause is improper neutralization of script-related HTML tags and inadequate output encoding when inlining critical CSS. An attacker can craft a malicious URL or modify page content to inject JavaScript that executes in the browser context of other users. The attack requires network access and users visiting an attacker-controlled or compromised page. The vulnerability is patched in version 16.1.2 and higher (including 16.2.0-rc.0); users can also downgrade to 16.0.x or override the critters dependency to version 0.0.20.
Affected products
- Angular @nguniversal/common 16.1.0 to 16.1.1
Timeline
- 2023-08-09: disclosed
- 2023-08-09: patched: Version 16.1.2 released with patch