{"id":"CVE-2024-21490","aliases":["CLSA-2026-1773706637","CLSA-2026-1773706638","CLSA-2026-1773793040","CLSA-2026-1773879465","CLSA-2026-1773879502","CLSA-2026-1773965926","CLSA-2026-1781657707","CLSA-2026-1781657708","CLSA-2026-1781657709","CLSA-2026-1787822123","DEBIAN-CVE-2024-21490","DLA-4242-1","EUVD-2024-0512","GHSA-28hp-fgcr-2r4h","GHSA-4w4v-5hc9-xrr2","GHSA-5cp4-xmrw-59wf","ROOT-APP-NPM-CVE-2024-21490","ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","UBUNTU-CVE-2024-21490"],"status":"published","title":"Cross-Site Scripting via JSONP","description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01891,"percentile":0.79845,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1333","CWE-79"],"published":"2019-06-27T17:25:42Z","modified":"2026-11-02T12:00:43Z","exploits":[{"source":"pocgithub","id":"RoninForge/roninforge-angularjs-migration","title":"RoninForge/roninforge-angularjs-migration","date":"2026-05-19","url":"https://github.com/RoninForge/roninforge-angularjs-migration"}],"fixes":[{"ecosystem":"npm","package":"angular","fixed_in":["1.6.0","1.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"angular","fixed_in":["1.7.9-tuxcare.8","1.6.10-tuxcare.8","1.5.11-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"angular.js","fixed_in":["1.8.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"angular.js","fixed_in":["1.8.3-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"angular","fixed_in":["1.8.3-aikido.2","1.4.14-aikido.1","1.8.3-aikido.3","1.4.14-aikido.2","1.3.0-aikido.1","1.3.0-aikido.2","1.8.3-aikido.4","1.3.0-aikido.3","1.8.3-aikido.5","1.4.14-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/angular","fixed_in":["1.8.3-root.io.1","1.8.3-root.io.2","1.4.14-root.io.1","1.8.3-root.io.3","1.4.14-root.io.2","1.3.0-root.io.1","1.3.0-root.io.2","1.8.3-root.io.4","1.3.0-root.io.3","1.8.3-root.io.5","1.4.14-root.io.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","fixed_in":["1.5.10-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","fixed_in":["1.7.9-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","fixed_in":["1.8.2-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","fixed_in":["1.8.3-1ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.8.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.8.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.bower:angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.8.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2-tuxcare.0"},{"fixed":"1.8.2-tuxcare.1"}]}],"versions":["1.8.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.1"}]}],"versions":["1.7.9"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.1"}]}],"versions":["1.6.10"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.1"}]}],"versions":["1.5.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.4-tuxcare.0"},{"fixed":"1.4.4-tuxcare.1"}]}],"versions":["1.4.4"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.8"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2","1.7.9-tuxcare.3","1.7.9-tuxcare.4","1.7.9-tuxcare.5","1.7.9-tuxcare.6","1.7.9-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.8"}]}],"versions":["1.6.10","1.6.10-tuxcare.1","1.6.10-tuxcare.2","1.6.10-tuxcare.3","1.6.10-tuxcare.4","1.6.10-tuxcare.5","1.6.10-tuxcare.6","1.6.10-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.8"}]}],"versions":["1.5.11","1.5.11-tuxcare.1","1.5.11-tuxcare.2","1.5.11-tuxcare.3","1.5.11-tuxcare.4","1.5.11-tuxcare.5","1.5.11-tuxcare.6","1.5.11-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.7-tuxcare.0"},{"fixed":"1.4.7-tuxcare.1"}]}],"versions":["1.4.7"],"bundled":12},{"source":"osv","ecosystem":"Debian:12","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1+deb12u1"}]}],"versions":["1.8.3-1","1.8.3-1+deb12u1~deb11u1"]},{"source":"osv","ecosystem":"Debian:13","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1+deb12u1~deb11u1"}]}],"versions":["1.8.2-2","1.8.3-1"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0"},{"last_affected":"1.8.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.8.3"}]}],"versions":["1.3.15","1.3.16","1.3.17","1.3.20","1.3.8","1.4.0","1.4.1","1.4.14","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-beta.0","1.5.0-beta.2","1.5.0-rc.0","1.5.0-rc.1","1.5.0-rc.2","1.5.1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.0-rc.2","1.6.1","1.6.10","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.0-rc.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8.0","1.8.1","1.8.2","1.8.3"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.bower:angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"last_affected":"1.8.3"}]}],"versions":["1.3.0","1.3.10","1.3.11","1.3.13","1.3.14","1.3.15","1.3.16","1.3.17","1.3.18","1.3.19","1.3.2","1.3.20","1.3.6","1.3.8","1.4.0","1.4.0-beta.5","1.4.0-beta.6","1.4.0-rc.1","1.4.0-rc.2","1.4.1","1.4.11","1.4.12","1.4.14","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-beta.0","1.5.0-beta.2","1.5.0-rc.0","1.5.0-rc.1","1.5.0-rc.2","1.5.1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.0-rc.2","1.6.1","1.6.10","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.7-1","1.6.8","1.6.9","1.7.0","1.7.0-rc.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8.0","1.8.2","1.8.3"]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-aikido.2"},{"fixed":"1.4.14-aikido.1"},{"fixed":"1.8.3-aikido.3"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.1"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.8.3-aikido.4"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.8.3-aikido.5"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-root.io.1"},{"fixed":"1.8.3-root.io.2"},{"fixed":"1.4.14-root.io.1"},{"fixed":"1.8.3-root.io.3"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.1"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.8.3-root.io.4"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.8.3-root.io.5"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.10-1ubuntu0.1~esm1"}]}],"versions":["1.5.10-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.9-1ubuntu0.1~esm1"}]}],"versions":["1.5.10-1","1.7.9-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-2ubuntu0.1"}]}],"versions":["1.8.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.24.04.1"}]}],"versions":["1.8.3-1"]}],"products":[{"vendor":"angular","product":"angular"},{"vendor":"angularjs","product":"angular.js"},{"vendor":"google","product":"angularjs"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771616"},{"url":"https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html","tags":["web"]},{"url":"https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1630","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28hp-fgcr-2r4h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21490","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4w4v-5hc9-xrr2"},{"url":"https://github.com/google/security-research/security/advisories/GHSA-5cp4-xmrw-59wf","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6","tags":["web"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"},{"url":"https://github.com/advisories/GHSA-mhp6-pxh8-r675","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-ANGULAR-570058","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5cp4-xmrw-59wf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-21490","tags":["advisory"]},{"url":"https://github.com/angular/angular.js","tags":["package"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-21490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21490","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7958-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-21490","description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T05:00:01.641Z","modified":"2026-07-06T15:25:05.623Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:04.681315Z"}],"euvd":[{"id":"EUVD-2024-0512","description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T05:00:01Z","modified":"2026-07-06T15:25:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high"}],"updated_at":"2026-11-02T18:20:13.172179Z"}],"ghsa":[{"id":"GHSA-4w4v-5hc9-xrr2","title":"angular vulnerable to super-linear runtime due to backtracking","description":"This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \n\n\n**Note:**\n\nThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T06:30:19Z","modified":"2025-11-03T22:32:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:39:05.278442Z"},{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2023-01-09T05:03:41Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:06.317379Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2023-01-09T05:01:45Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2024-21490","description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T05:15:08.65Z","modified":"2026-06-29T16:16:33.937Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:09:35.738752Z"}],"osv":[{"id":"CVE-2024-21490","description":"This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T05:15:08.65Z","modified":"2026-03-15T22:48:22.750777Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-21490","description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T05:15:08.65Z","modified":"2026-11-02T12:00:43.072215923Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-4w4v-5hc9-xrr2","title":"angular vulnerable to super-linear runtime due to backtracking","description":"This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \n\n\n**Note:**\n\nThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T06:30:19Z","modified":"2026-09-10T03:50:09.714122064Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2021-10-08T21:25:58Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"UBUNTU-CVE-2024-21490","description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.    **Note:**  This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","status":"published","published":"2024-02-10T05:15:00Z","modified":"2026-10-28T20:15:35.013788701Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"CLSA-2026-1773706637","title":"TuxCare security update for angular (10 CVEs)","description":"TuxCare rebuilt angular to address 10 CVEs. Fixed in 1.8.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-11-10T19:45:05.482451099Z","updated_at":"2026-11-10T20:12:44.559934Z"},{"id":"CLSA-2026-1773706638","title":"TuxCare security update for angular (7 CVEs)","description":"TuxCare rebuilt angular to address 7 CVEs. Fixed in 1.7.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.767005265Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773793040","title":"TuxCare security update for angular (8 CVEs)","description":"TuxCare rebuilt angular to address 8 CVEs. Fixed in 1.6.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-11-10T19:45:05.522757621Z","updated_at":"2026-11-10T20:12:44.559934Z"},{"id":"CLSA-2026-1773879465","title":"TuxCare security update for angular (7 CVEs)","description":"TuxCare rebuilt angular to address 7 CVEs. Fixed in 1.5.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.001067569Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879502","title":"TuxCare security update for angular (13 CVEs)","description":"TuxCare rebuilt angular to address 13 CVEs. Fixed in 1.4.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.657690559Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773965926","title":"TuxCare security update for angular (7 CVEs)","description":"TuxCare rebuilt angular to address 7 CVEs. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-11-10T19:45:07.507227448Z","updated_at":"2026-11-10T20:12:44.559934Z"},{"id":"CLSA-2026-1781657707","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.7.9-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.979621536Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781657708","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.6.10-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:32.228330766Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781657709","title":"TuxCare security update for angular (2 CVEs)","description":"TuxCare rebuilt angular to address 2 CVEs. Fixed in 1.5.11-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.676968067Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1787822123","title":"TuxCare security update for angular (14 CVEs)","description":"TuxCare rebuilt angular to address 14 CVEs. Fixed in 1.4.7-tuxcare.1.","status":"published","published":"2026-08-27T09:15:23Z","modified":"2026-10-15T09:48:03.127937253Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-4242-1","title":"angular.js - security update","status":"published","published":"2025-07-20T00:00:00Z","modified":"2026-03-09T02:10:45.874056Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2021-02-24T18:32:36Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-CVE-2024-21490","title":"CVE-2024-21490 in angular - Patched by Root","description":"Root has patched CVE-2024-21490 in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:15.287480322Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","title":"GHSA-28hp-fgcr-2r4h in angular - Patched by Root","description":"Root has patched GHSA-28hp-fgcr-2r4h in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:12.427027284Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","title":"GHSA-5cp4-xmrw-59wf in angular - Patched by Root","description":"Root has patched GHSA-5cp4-xmrw-59wf in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:15.319898872Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}