Executive brief
md-data-table is a popular Angular library used to display tabular data in web applications. The library contains a cross-site scripting vulnerability in its mdt-row component that allows attackers to inject malicious JavaScript code if they control the data being displayed, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of affected users.
Technical details
The vulnerability is a reflected/stored cross-site scripting (XSS) flaw affecting all versions of md-data-table, specifically within the mdt-row rendering component. The root cause is insufficient input sanitization—user-controlled data rendered by mdt-row is not properly escaped or sanitized before being inserted into the DOM. An attacker with control over table row data can inject arbitrary HTML and JavaScript code. The attack is exploitable if user data is passed directly to the table without sanitization. As of the advisory publication date, no patch has been released; the recommendation is to either switch to an alternative library or implement strict server-side data sanitization before rendering.
Affected products
- md-data-table md-data-table all
Timeline
- 2020-09-01: disclosed