{"id":"CVE-2022-25869","aliases":["CLSA-2026-1773706637","CLSA-2026-1773706638","CLSA-2026-1773793040","CLSA-2026-1773879465","CLSA-2026-1773879502","CLSA-2026-1773965926","CLSA-2026-1781657707","CLSA-2026-1781657708","CLSA-2026-1781657709","CLSA-2026-1787822123","DEBIAN-CVE-2022-25869","EUVD-2022-6389","GHSA-28hp-fgcr-2r4h","GHSA-5cp4-xmrw-59wf","GHSA-prc3-vjfx-vhm9","ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","UBUNTU-CVE-2022-25869"],"status":"published","title":"Cross-Site Scripting via JSONP","description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0768,"percentile":0.94633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2019-06-27T17:25:42Z","modified":"2026-11-03T08:02:47Z","exploits":[{"source":"pocgithub","id":"neverendingsupport/angularjs-poc-cve-2022-25869","title":"neverendingsupport/angularjs-poc-cve-2022-25869","date":"2025-06-30","url":"https://github.com/neverendingsupport/angularjs-poc-cve-2022-25869"}],"fixes":[{"ecosystem":"npm","package":"angular","fixed_in":["1.6.0","1.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"angular","fixed_in":["1.7.9-tuxcare.8","1.6.10-tuxcare.8","1.5.11-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"angular","fixed_in":["1.4.14-aikido.2","1.3.0-aikido.2","1.3.0-aikido.3","1.4.14-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/angular","fixed_in":["1.4.14-root.io.2","1.3.0-root.io.2","1.3.0-root.io.3","1.4.14-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2-tuxcare.0"},{"fixed":"1.8.2-tuxcare.1"}]}],"versions":["1.8.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.1"}]}],"versions":["1.7.9"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.1"}]}],"versions":["1.6.10"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.1"}]}],"versions":["1.5.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.4-tuxcare.0"},{"fixed":"1.4.4-tuxcare.1"}]}],"versions":["1.4.4"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.8"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2","1.7.9-tuxcare.3","1.7.9-tuxcare.4","1.7.9-tuxcare.5","1.7.9-tuxcare.6","1.7.9-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.8"}]}],"versions":["1.6.10","1.6.10-tuxcare.1","1.6.10-tuxcare.2","1.6.10-tuxcare.3","1.6.10-tuxcare.4","1.6.10-tuxcare.5","1.6.10-tuxcare.6","1.6.10-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.8"}]}],"versions":["1.5.11","1.5.11-tuxcare.1","1.5.11-tuxcare.2","1.5.11-tuxcare.3","1.5.11-tuxcare.4","1.5.11-tuxcare.5","1.5.11-tuxcare.6","1.5.11-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.7-tuxcare.0"},{"fixed":"1.4.7-tuxcare.1"}]}],"versions":["1.4.7"],"bundled":12},{"source":"osv","ecosystem":"Debian:12","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-1","1.8.3-1+deb12u1","1.8.3-1+deb12u1~deb11u1","1.8.3-2","1.8.3-3"]},{"source":"osv","ecosystem":"Debian:13","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3"]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.8.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.28-1ubuntu2","1.2.28-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.10-1","1.5.10-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.10-1","1.7.9-1","1.7.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.2-2","1.8.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-1","1.8.3-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-1","1.8.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3"]}],"products":[{"vendor":"angular","product":"angular"},{"vendor":"angularjs","product":"angularjs"},{"vendor":"google","product":"angularjs"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781","tags":["web","report"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617","tags":["web"]},{"url":"https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://glitch.com/edit/%23%21/angular-repro-textarea-xss","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1630","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28hp-fgcr-2r4h"},{"url":"https://github.com/google/security-research/security/advisories/GHSA-5cp4-xmrw-59wf","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6","tags":["web"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"},{"url":"https://github.com/advisories/GHSA-mhp6-pxh8-r675","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-ANGULAR-570058","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5cp4-xmrw-59wf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25869","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-prc3-vjfx-vhm9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-25869","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released","tags":["web"]},{"url":"https://github.com/angular/angular.js","tags":["package"]},{"url":"https://www.npmjs.com/package/angular","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-25869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25869","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-25869","description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.","status":"published","published":"2022-07-15T20:02:02.727Z","modified":"2025-07-28T09:59:04.148Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-6389","description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.","status":"published","published":"2022-07-15T20:02:02Z","modified":"2025-07-28T09:59:04Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium"}],"updated_at":"2026-11-02T20:32:03.907132Z"}],"ghsa":[{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2023-01-09T05:03:41Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:06.317379Z"},{"id":"GHSA-prc3-vjfx-vhm9","title":"Angular (deprecated package) Cross-site Scripting","description":"All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of `\u003ctextarea\u003e` elements.\n\nNPM package [angular](https://www.npmjs.com/package/angular) is deprecated. Those who want to receive security updates should use the actively maintained package [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2022-07-16T00:00:20Z","modified":"2025-07-28T13:10:23Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:51.864708Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2023-01-09T05:01:45Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2022-25869","description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.","status":"published","published":"2022-07-15T20:15:08.487Z","modified":"2026-06-17T04:34:25.19Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"CVE-2022-25869","description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.","status":"published","published":"2022-07-15T20:15:08.487Z","modified":"2026-03-15T22:44:55.709478Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-25869","description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.","status":"published","published":"2022-07-15T20:15:08.487Z","modified":"2026-11-03T08:02:47.561437476Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2021-10-08T21:25:58Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-prc3-vjfx-vhm9","title":"Angular (deprecated package) Cross-site Scripting","description":"All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of `\u003ctextarea\u003e` elements.\n\nNPM package [angular](https://www.npmjs.com/package/angular) is deprecated. Those who want to receive security updates should use the actively maintained package [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2022-07-16T00:00:20Z","modified":"2026-09-10T03:49:55.291770163Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2022-25869","description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.","status":"published","published":"2022-07-15T20:15:00Z","modified":"2026-10-17T12:56:02.477815104Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CLSA-2026-1773706637","title":"TuxCare security update for angular (11 CVEs)","description":"TuxCare rebuilt angular to address 11 CVEs. Fixed in 1.8.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.685142674Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773706638","title":"TuxCare security update for angular (7 CVEs)","description":"TuxCare rebuilt angular to address 7 CVEs. Fixed in 1.7.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.767005265Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773793040","title":"TuxCare security update for angular (9 CVEs)","description":"TuxCare rebuilt angular to address 9 CVEs. Fixed in 1.6.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.16136228Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879465","title":"TuxCare security update for angular (7 CVEs)","description":"TuxCare rebuilt angular to address 7 CVEs. Fixed in 1.5.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.001067569Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879502","title":"TuxCare security update for angular (13 CVEs)","description":"TuxCare rebuilt angular to address 13 CVEs. Fixed in 1.4.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.657690559Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773965926","title":"TuxCare security update for angular (8 CVEs)","description":"TuxCare rebuilt angular to address 8 CVEs. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:01.480966302Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1781657707","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.7.9-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.979621536Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781657708","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.6.10-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:32.228330766Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781657709","title":"TuxCare security update for angular (2 CVEs)","description":"TuxCare rebuilt angular to address 2 CVEs. Fixed in 1.5.11-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.676968067Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1787822123","title":"TuxCare security update for angular (14 CVEs)","description":"TuxCare rebuilt angular to address 14 CVEs. Fixed in 1.4.7-tuxcare.1.","status":"published","published":"2026-08-27T09:15:23Z","modified":"2026-10-15T09:48:03.127937253Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2021-02-24T18:32:36Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","title":"GHSA-28hp-fgcr-2r4h in angular - Patched by Root","description":"Root has patched GHSA-28hp-fgcr-2r4h in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:12.427027284Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","title":"GHSA-5cp4-xmrw-59wf in angular - Patched by Root","description":"Root has patched GHSA-5cp4-xmrw-59wf in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:15.319898872Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}