# CVE-2019-14863: AngularJS cross-site scripting in xlink:href sanitization

Source: https://junglewise.ai/threats/cve-2019-14863-angularjs-cross-site-scripting-in-xlink-href-sanitization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-02-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-14863 · Severity: low · CVSS 3.1 · Published 2020-02-14

AngularJS is a popular JavaScript framework used to build dynamic web applications. The framework failed to properly sanitize SVG xlink:href attributes, allowing attackers to inject and execute malicious JavaScript code in users' browsers if they interact with a page containing user-controlled SVG attributes. This could lead to account compromise, credential theft, or redirection to malicious sites.

Technologies: [angular (npm)](https://junglewise.ai/threats/technologies/angular). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-14863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-14863 being exploited in the wild.

**How severe is CVE-2019-14863?** Low severity, with a CVSS score of 3.1, published 14 February 2020.

**Which products and versions are affected?** angular (npm) SEMVER:introduced=0,fixed=1.5.0-beta.1.

**Is there a fix for CVE-2019-14863?** Yes. angular (npm): upgrade to 1.5.0-beta.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-14863 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-14863?** Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- angular (npm): upgrade to 1.5.0-beta.1 or later

  ```sh
  npm install angular@1.5.0-beta.1
  ```


## Technical details

This is a cross-site scripting (XSS) vulnerability (CWE-79) in AngularJS's HTML sanitization routines. The framework's sanitizer failed to properly validate and escape xlink:href attributes in SVG elements, a common vector for injecting JavaScript protocol handlers. The vulnerability requires user interaction (victim must click or interact with the malicious SVG element) and the xlink:href value must be user-controlled or attacker-influenced. An attacker can craft a malicious SVG document that, when rendered by a vulnerable AngularJS application, executes arbitrary JavaScript with the privileges of the authenticated user. The fix is available in AngularJS version 1.5.0-beta.1 and later.

## Affected products

- AngularJS AngularJS prior to 1.5.0-beta.1

## Identifiers

- CVE-2019-14863
- GHSA-r5fx-8r73-v86c

## Timeline

- 2020-02-14: disclosed
- 2015-08-07: patched: Fix merged in PR #12524

## References

- [https://github.com/angular/angular.js/pull/12524](https://github.com/angular/angular.js/pull/12524)

## Related threats

- [Google AngularJS XSS bypass in Strict Contextual Escaping](https://junglewise.ai/threats/cve-2026-11998-google-angularjs-xss-bypass-in-strict-contextual-escaping)
- [AngularJS improper SVG element sanitization bypass](https://junglewise.ai/threats/cve-2025-0716-angularjs-improper-svg-element-sanitization-bypass)
- [AngularJS image srcset attribute bypass in Content Security Policy](https://junglewise.ai/threats/cve-2024-8372-angularjs-image-srcset-attribute-bypass-in-content-security-policy)
- [AngularJS srcset attribute sanitization bypass](https://junglewise.ai/threats/cve-2024-8373-angularjs-srcset-attribute-sanitization-bypass)
- [AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset)