Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, with a CVSS score of 7.1, published 9 August 2023.
- Which products and versions are affected?
- @nguniversal/common (npm) SEMVER:introduced=16.1.0,fixed=16.1.2.
- Is there a fix for This vulnerability?
- Yes. @nguniversal/common (npm): upgrade to 16.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network.
- Am I affected?
- Check whether you run @nguniversal/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @nguniversal/common (npm): upgrade to 16.1.2 or later
npm install @nguniversal/common@16.1.2
Technical details
The vulnerability is a reflected/stored XSS (CWE-79, CWE-116) in Angular Universal's critical CSS inlining feature, affecting versions 16.1.0–16.1.1. The root cause is improper neutralization of script-related HTML tags and inadequate output encoding when inlining critical CSS. An attacker can craft a malicious URL or modify page content to inject JavaScript that executes in the browser context of other users. The attack requires network access and users visiting an attacker-controlled or compromised page. The vulnerability is patched in version 16.1.2 and higher (including 16.2.0-rc.0); users can also downgrade to 16.0.x or override the critters dependency to version 0.0.20.
Affected products
- Angular @nguniversal/common 16.1.0 to 16.1.1
Timeline
- 2023-08-09: disclosed
- 2023-08-09: patched: Version 16.1.2 released with patch