Executive brief
Angular (the deprecated npm package) contains a cross-site scripting vulnerability affecting Internet Explorer users due to insecure page caching. An attacker can inject malicious scripts into textarea elements that are interpolated by the framework, potentially stealing user session data or performing actions on behalf of users viewing affected pages.
Technical details
This is a Cross-site Scripting (CWE-79) vulnerability in the deprecated npm package 'angular' affecting all versions through 1.8.3. The vulnerability stems from insecure page caching behavior in Internet Explorer, where textarea elements can be interpolated with unescaped user-controlled content. An attacker can craft malicious HTML containing textarea tags that, when cached by IE and subsequently processed by Angular, execute arbitrary JavaScript in the victim's browser context. User interaction (visiting a malicious page) is required. The vulnerability does not affect the actively maintained @angular/core package; users should migrate away from the deprecated 'angular' package.
Affected products
- Angular angular through 1.8.3
Timeline
- 2022-07-15: disclosed
- 2022-07-16: advisory