# CVE-2022-25869: Angular Cross-site Scripting in textarea caching

Source: https://junglewise.ai/threats/cve-2022-25869-angular-cross-site-scripting-in-textarea-caching  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25869 · Severity: low · CVSS 3.1 · Published 2022-07-16

Angular (the deprecated npm package) contains a cross-site scripting vulnerability affecting Internet Explorer users due to insecure page caching. An attacker can inject malicious scripts into textarea elements that are interpolated by the framework, potentially stealing user session data or performing actions on behalf of users viewing affected pages.

Technologies: [angular (npm)](https://junglewise.ai/threats/technologies/angular). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25869 being exploited in the wild.

**How severe is CVE-2022-25869?** Low severity, with a CVSS score of 3.1, published 16 July 2022.

**Which products and versions are affected?** angular (npm) SEMVER:introduced=0,last_affected=1.8.3.

**Is there a fix for CVE-2022-25869?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-25869 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-25869?** Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Cross-site Scripting (CWE-79) vulnerability in the deprecated npm package 'angular' affecting all versions through 1.8.3. The vulnerability stems from insecure page caching behavior in Internet Explorer, where textarea elements can be interpolated with unescaped user-controlled content. An attacker can craft malicious HTML containing textarea tags that, when cached by IE and subsequently processed by Angular, execute arbitrary JavaScript in the victim's browser context. User interaction (visiting a malicious page) is required. The vulnerability does not affect the actively maintained @angular/core package; users should migrate away from the deprecated 'angular' package.

## Affected products

- Angular angular through 1.8.3

## Identifiers

- CVE-2022-25869
- GHSA-prc3-vjfx-vhm9

## Timeline

- 2022-07-15: disclosed
- 2022-07-16: advisory

## References

- [https://glitch.com/edit/%23%21/angular-repro-textarea-xss](https://glitch.com/edit/%23%21/angular-repro-textarea-xss)

## Related threats

- [Google AngularJS XSS bypass in Strict Contextual Escaping](https://junglewise.ai/threats/cve-2026-11998-google-angularjs-xss-bypass-in-strict-contextual-escaping)
- [AngularJS improper SVG element sanitization bypass](https://junglewise.ai/threats/cve-2025-0716-angularjs-improper-svg-element-sanitization-bypass)
- [AngularJS image srcset attribute bypass in Content Security Policy](https://junglewise.ai/threats/cve-2024-8372-angularjs-image-srcset-attribute-bypass-in-content-security-policy)
- [AngularJS srcset attribute sanitization bypass](https://junglewise.ai/threats/cve-2024-8373-angularjs-srcset-attribute-sanitization-bypass)
- [AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset)