{"id":"CVE-2019-10768","aliases":["CLSA-2026-1773793040","CLSA-2026-1773879465","CLSA-2026-1773879502","CLSA-2026-1781657707","CLSA-2026-1781657708","CLSA-2026-1781657709","CLSA-2026-1787822123","DEBIAN-CVE-2019-10768","EUVD-2019-0737","GHSA-28hp-fgcr-2r4h","GHSA-5cp4-xmrw-59wf","GHSA-89mq-4x47-5v83","RHSA-2022:8849","RHSA-2022:8866","RHSA-2023:0274","ROOT-APP-NPM-CVE-2019-10768","ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","SNYK-JS-ANGULAR-534884","UBUNTU-CVE-2019-10768"],"status":"published","title":"Cross-Site Scripting via JSONP","description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01982,"percentile":0.80702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-20","CWE-79","CWE-915"],"published":"2019-06-27T17:25:42Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"npm","package":"angular","fixed_in":["1.6.0","1.8.0","1.7.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"angular","fixed_in":["1.7.9-tuxcare.8","1.6.10-tuxcare.8","1.5.11-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"angular.js","fixed_in":["1.7.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"angular.js","fixed_in":["1.7.9-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"XStatic-Angular-common","fixed_in":["1:1.5.8.0-13.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python-XStatic-Angular","fixed_in":["1:1.5.8.0-13.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-XStatic-Angular","fixed_in":["1:1.5.8.0-13.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"XStatic-Angular-common","fixed_in":["1:1.5.8.0-13.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python-XStatic-Angular","fixed_in":["1:1.5.8.0-13.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-XStatic-Angular","fixed_in":["1:1.5.8.0-13.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"XStatic-Angular-common","fixed_in":["1:1.5.8.0-15.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"python-XStatic-Angular","fixed_in":["1:1.5.8.0-15.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-XStatic-Angular","fixed_in":["1:1.5.8.0-15.el9ost"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"angular","fixed_in":["1.4.14-aikido.1","1.4.14-aikido.2","1.3.0-aikido.1","1.3.0-aikido.2","1.3.0-aikido.3","1.4.14-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/angular","fixed_in":["1.4.14-root.io.1","1.4.14-root.io.2","1.3.0-root.io.1","1.3.0-root.io.2","1.3.0-root.io.3","1.4.14-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.9"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.1"}]}],"versions":["1.6.10"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.1"}]}],"versions":["1.5.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.4-tuxcare.0"},{"fixed":"1.4.4-tuxcare.1"}]}],"versions":["1.4.4"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.8"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2","1.7.9-tuxcare.3","1.7.9-tuxcare.4","1.7.9-tuxcare.5","1.7.9-tuxcare.6","1.7.9-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.8"}]}],"versions":["1.6.10","1.6.10-tuxcare.1","1.6.10-tuxcare.2","1.6.10-tuxcare.3","1.6.10-tuxcare.4","1.6.10-tuxcare.5","1.6.10-tuxcare.6","1.6.10-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.8"}]}],"versions":["1.5.11","1.5.11-tuxcare.1","1.5.11-tuxcare.2","1.5.11-tuxcare.3","1.5.11-tuxcare.4","1.5.11-tuxcare.5","1.5.11-tuxcare.6","1.5.11-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.7-tuxcare.0"},{"fixed":"1.4.7-tuxcare.1"}]}],"versions":["1.4.7"],"bundled":12},{"source":"osv","ecosystem":"Debian:12","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.9-1"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.9"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"XStatic-Angular-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-13.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-XStatic-Angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-13.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-XStatic-Angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-13.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"XStatic-Angular-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-13.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-XStatic-Angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-13.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-XStatic-Angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-13.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"XStatic-Angular-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-15.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"python-XStatic-Angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-15.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-XStatic-Angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.8.0-15.el9ost"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.1"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.1"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.1"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.1"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.10-1","1.5.10-1ubuntu0.1~esm1"]}],"products":[{"vendor":"angularjs","product":"angularjs"},{"vendor":"google","product":"angularjs"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-ANGULAR-534884","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1630","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28hp-fgcr-2r4h"},{"url":"https://github.com/google/security-research/security/advisories/GHSA-5cp4-xmrw-59wf","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6","tags":["web"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"},{"url":"https://github.com/advisories/GHSA-mhp6-pxh8-r675","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-ANGULAR-570058","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5cp4-xmrw-59wf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10768","tags":["advisory"]},{"url":"https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3","tags":["web","article"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","tags":["web"]},{"url":"https://github.com/angular/angular.js/pull/16913","tags":["web"]},{"url":"https://github.com/advisories/GHSA-89mq-4x47-5v83"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10768","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released","tags":["web"]},{"url":"https://github.com/angular/angular.js","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8849","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813309","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8849.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10768","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8866","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8866.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0274","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0274.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10768","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-10768","description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","status":"published","published":"2019-11-19T20:07:49Z","modified":"2024-08-04T22:32:01.679Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-0737","description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","status":"published","published":"2019-11-19T20:07:49Z","modified":"2024-08-04T22:32:01Z","updated_at":"2026-11-03T02:40:51.633398Z"}],"ghsa":[{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2023-01-09T05:03:41Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:06.317379Z"},{"id":"GHSA-89mq-4x47-5v83","title":"angular Prototype Pollution vulnerability","description":"Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function `merge()` does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n## Recommendation\n\nUpgrade to version 1.7.9 or later. The function was already deprecated and upgrades are not expected to break functionality.","status":"published","published":"2019-11-20T15:29:43Z","modified":"2025-11-20T19:30:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-915","CWE-1321"],"updated_at":"2026-11-02T14:39:10.178331Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2023-01-09T05:01:45Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2019-10768","description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","status":"published","published":"2019-11-19T21:15:11.703Z","modified":"2026-06-17T02:11:38.143Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:05:37.024431Z"}],"osv":[{"id":"CVE-2019-10768","description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","status":"published","published":"2019-11-19T21:15:11.703Z","modified":"2026-10-24T10:30:49.30031981Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10768","description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","status":"published","published":"2019-11-19T21:15:11.703Z","modified":"2026-09-21T07:00:36.678112415Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2021-10-08T21:25:58Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-89mq-4x47-5v83","title":"angular Prototype Pollution vulnerability","description":"Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function `merge()` does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n## Recommendation\n\nUpgrade to version 1.7.9 or later. The function was already deprecated and upgrades are not expected to break functionality.","status":"published","published":"2019-11-20T15:29:43Z","modified":"2026-07-08T05:56:32.951320191Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-1321","CWE-20","CWE-915"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"RHSA-2022:8849","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) security update","status":"published","published":"2024-09-20T13:59:25Z","modified":"2026-10-13T10:03:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8866","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update","status":"published","published":"2024-09-20T13:59:33Z","modified":"2026-10-13T10:03:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0274","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-XStatic-Angular) security update","status":"published","published":"2024-09-20T13:59:40Z","modified":"2026-10-13T10:03:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2019-10768","description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","status":"published","published":"2019-11-19T21:15:00Z","modified":"2026-01-14T20:12:37.868197Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"CLSA-2026-1773793040","title":"TuxCare security update for angular (9 CVEs)","description":"TuxCare rebuilt angular to address 9 CVEs. Fixed in 1.6.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.16136228Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879465","title":"TuxCare security update for angular (7 CVEs)","description":"TuxCare rebuilt angular to address 7 CVEs. Fixed in 1.5.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.001067569Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879502","title":"TuxCare security update for angular (13 CVEs)","description":"TuxCare rebuilt angular to address 13 CVEs. Fixed in 1.4.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.657690559Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1781657707","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.7.9-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.979621536Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781657708","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.6.10-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:32.228330766Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781657709","title":"TuxCare security update for angular (2 CVEs)","description":"TuxCare rebuilt angular to address 2 CVEs. Fixed in 1.5.11-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.676968067Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1787822123","title":"TuxCare security update for angular (14 CVEs)","description":"TuxCare rebuilt angular to address 14 CVEs. Fixed in 1.4.7-tuxcare.1.","status":"published","published":"2026-08-27T09:15:23Z","modified":"2026-10-15T09:48:03.127937253Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2021-02-24T18:32:36Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-CVE-2019-10768","title":"CVE-2019-10768 in angular - Patched by Root","description":"Root has patched CVE-2019-10768 in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:20.574105571Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","title":"GHSA-28hp-fgcr-2r4h in angular - Patched by Root","description":"Root has patched GHSA-28hp-fgcr-2r4h in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:12.427027284Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","title":"GHSA-5cp4-xmrw-59wf in angular - Patched by Root","description":"Root has patched GHSA-5cp4-xmrw-59wf in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:15.319898872Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}