# CVE-2024-8373: AngularJS srcset attribute sanitization bypass

Source: https://junglewise.ai/threats/cve-2024-8373-angularjs-srcset-attribute-sanitization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-8373 · Severity: low · CVSS 3.1 · Published 2024-09-09

AngularJS, a JavaScript framework used to build dynamic web applications, improperly sanitizes the srcset attribute in HTML image elements. This allows attackers to bypass content security restrictions that prevent unauthorized image loading, potentially leading to content spoofing attacks where users are shown misleading images or content that appears to come from a trusted source.

Technologies: [angular (npm)](https://junglewise.ai/threats/technologies/angular). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-8373 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-8373 being exploited in the wild.

**How severe is CVE-2024-8373?** Low severity, with a CVSS score of 3.1, published 9 September 2024.

**Which products and versions are affected?** angular (npm) SEMVER:introduced=0,last_affected=1.8.3.

**Is there a fix for CVE-2024-8373?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-8373 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-8373?** Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a content spoofing issue (CWE-791) resulting from improper sanitization of the srcset attribute in <source> HTML elements within AngularJS. The framework fails to properly validate or escape srcset values, allowing attackers to craft malicious HTML that bypasses common Content Security Policy (CSP) restrictions on image sources. The attack requires no authentication or user interaction and is network-reachable. An attacker can inject arbitrary image sources or URLs, leading to unauthorized image loading and potential content spoofing attacks. This vulnerability affects all versions of AngularJS up to and including 1.8.3; however, AngularJS is end-of-life and will not receive patches.

## Affected products

- Google AngularJS All versions up to and including 1.8.3

## Identifiers

- CVE-2024-8373
- GHSA-mqm9-c95h-x2p6

## Timeline

- 2024-09-09: disclosed: Published as GHSA-mqm9-c95h-x2p6 / CVE-2024-8373
- 2024-09-09: other: NVD published

## References

- [https://codepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b](https://codepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b)

## Related threats

- [Google AngularJS XSS bypass in Strict Contextual Escaping](https://junglewise.ai/threats/cve-2026-11998-google-angularjs-xss-bypass-in-strict-contextual-escaping)
- [AngularJS improper SVG element sanitization bypass](https://junglewise.ai/threats/cve-2025-0716-angularjs-improper-svg-element-sanitization-bypass)
- [AngularJS image srcset attribute bypass in Content Security Policy](https://junglewise.ai/threats/cve-2024-8372-angularjs-image-srcset-attribute-bypass-in-content-security-policy)
- [AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset)
- [Google AngularJS ReDoS in angular.copy utility](https://junglewise.ai/threats/cve-2023-26116-google-angularjs-redos-in-angular-copy-utility)