{"id":"CVE-2024-8372","aliases":["CLSA-2026-1773706637","CLSA-2026-1773879502","CLSA-2026-1773965928","CLSA-2026-1774052344","CLSA-2026-1774052347","CLSA-2026-1774052358","CLSA-2026-1781657707","CLSA-2026-1781657708","CLSA-2026-1781657709","CLSA-2026-1787822123","DEBIAN-CVE-2024-8372","DLA-4242-1","EUVD-2024-2834","GHSA-28hp-fgcr-2r4h","GHSA-5cp4-xmrw-59wf","GHSA-m9gf-397r-hwpg","ROOT-APP-NPM-CVE-2024-8372","ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","UBUNTU-CVE-2024-8372"],"status":"published","title":"AngularJS improper sanitization in 'srcset' attribute","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00609,"percentile":0.49437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1289","CWE-79"],"published":"2019-06-27T17:25:42Z","modified":"2026-11-02T12:03:12Z","fixes":[{"ecosystem":"npm","package":"angular","fixed_in":["1.6.0","1.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"angular","fixed_in":["1.7.9-tuxcare.8","1.6.10-tuxcare.8","1.5.11-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"angular.js","fixed_in":["1.8.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"angular.js","fixed_in":["1.8.3-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"angular","fixed_in":["1.8.3-aikido.3","1.4.14-aikido.2","1.8.3-aikido.4","1.8.3-aikido.5","1.4.14-aikido.3","1.3.0-aikido.2","1.3.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/angular","fixed_in":["1.8.3-root.io.3","1.4.14-root.io.2","1.8.3-root.io.4","1.8.3-root.io.5","1.4.14-root.io.3","1.3.0-root.io.2","1.3.0-root.io.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","fixed_in":["1.5.10-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","fixed_in":["1.7.9-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","fixed_in":["1.8.2-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","fixed_in":["1.8.3-1ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-rc.4"},{"last_affected":"1.8.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2-tuxcare.0"},{"fixed":"1.8.2-tuxcare.1"}]}],"versions":["1.8.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.4-tuxcare.0"},{"fixed":"1.4.4-tuxcare.1"}]}],"versions":["1.4.4"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.2"}]}],"versions":["1.8.3","1.8.3-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.2"}]}],"versions":["1.7.9","1.7.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.2"}]}],"versions":["1.6.10","1.6.10-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.2"}]}],"versions":["1.5.11","1.5.11-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.8"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2","1.7.9-tuxcare.3","1.7.9-tuxcare.4","1.7.9-tuxcare.5","1.7.9-tuxcare.6","1.7.9-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.8"}]}],"versions":["1.6.10","1.6.10-tuxcare.1","1.6.10-tuxcare.2","1.6.10-tuxcare.3","1.6.10-tuxcare.4","1.6.10-tuxcare.5","1.6.10-tuxcare.6","1.6.10-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.8"}]}],"versions":["1.5.11","1.5.11-tuxcare.1","1.5.11-tuxcare.2","1.5.11-tuxcare.3","1.5.11-tuxcare.4","1.5.11-tuxcare.5","1.5.11-tuxcare.6","1.5.11-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.7-tuxcare.0"},{"fixed":"1.4.7-tuxcare.1"}]}],"versions":["1.4.7"],"bundled":12},{"source":"osv","ecosystem":"Debian:12","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1+deb12u1"}]}],"versions":["1.8.3-1","1.8.3-1+deb12u1~deb11u1"]},{"source":"osv","ecosystem":"Debian:13","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1+deb12u1~deb11u1"}]}],"versions":["1.8.2-2","1.8.3-1"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"npm","package":"angular","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0-rc.4"},{"last_affected":"1.8.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-aikido.3"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.8.3-aikido.4"},{"fixed":"1.8.3-aikido.5"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-root.io.3"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.8.3-root.io.4"},{"fixed":"1.8.3-root.io.5"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-aikido.2"},{"fixed":"1.3.0-aikido.2"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.4.14-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-root.io.2"},{"fixed":"1.3.0-root.io.2"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.4.14-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.10-1ubuntu0.1~esm1"}]}],"versions":["1.5.10-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.9-1ubuntu0.1~esm1"}]}],"versions":["1.5.10-1","1.7.9-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-2ubuntu0.1"}]}],"versions":["1.8.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.24.04.1"}]}],"versions":["1.8.3-1"]}],"products":[{"vendor":"angularjs","product":"angular.js"},{"vendor":"angularjs","product":"angularjs"},{"vendor":"google","product":"angularjs"},{"vendor":"netapp","product":"active_iq_unified_manager"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2024-8372","tags":["third-party-advisory","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017","tags":["technical-description","exploit","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241122-0002/","tags":["Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html","tags":["web"]},{"url":"https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1630","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28hp-fgcr-2r4h"},{"url":"https://github.com/google/security-research/security/advisories/GHSA-5cp4-xmrw-59wf","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2","tags":["web"]},{"url":"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6","tags":["web"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"},{"url":"https://github.com/advisories/GHSA-mhp6-pxh8-r675","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-ANGULAR-570058","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5cp4-xmrw-59wf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8372","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241122-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m9gf-397r-hwpg"},{"url":"https://registry.npmjs.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8372.json","tags":["advisory"]},{"url":"https://github.com/angular/angular.js","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-8372","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-8372","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8372","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7958-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-8372","title":"AngularJS improper sanitization in 'srcset' attribute","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T14:46:03.134Z","modified":"2025-11-03T19:34:58.181Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T14:34:09.216761Z"}],"euvd":[{"id":"EUVD-2024-2834","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T14:46:03Z","modified":"2025-11-03T19:34:58Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2023-01-09T05:03:41Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:06.317379Z"},{"id":"GHSA-m9gf-397r-hwpg","title":"AngularJS allows attackers to bypass common image source restrictions","description":"Improper sanitization of the value of the `[srcset]` attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T15:30:41Z","modified":"2025-11-03T22:48:15Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T14:39:05.278442Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2023-01-09T05:01:45Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2024-8372","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T15:15:12.56Z","modified":"2026-06-17T08:22:27.313Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"CVE-2024-8372","title":"AngularJS improper sanitization in 'srcset' attribute","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T14:46:03.134Z","modified":"2026-10-28T02:30:48.735690909Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"DEBIAN-CVE-2024-8372","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .  This issue affects AngularJS versions 1.3.0-rc.4 and greater.  Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T15:15:12.56Z","modified":"2026-11-02T12:03:12.485192503Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-5cp4-xmrw-59wf","title":"XSS via JQLite DOM manipulation functions in AngularJS","description":"### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `\u003cdiv\u003e\u003cstyle\u003e\u003cstyle/\u003e\u003cimg src=x onerror=\"alert(1337)\"/\u003e` \n```\nNote that the style element is not closed and `\u003cimg` would be a text node inside the style if inserted into the DOM as-is.\nAs such, some HTML sanitizers would leave the `\u003cimg` as is without processing it and stripping the `onerror` attribute.\n\n```javascript\nangular.element(document).append(inertPayload);\n```\nThis will alert, as `\u003cstyle/\u003e` will be replaced with `\u003cstyle\u003e\u003c/style\u003e` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery \u003c3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `\u003coption\u003e\u003cstyle\u003e\u003c/option\u003e`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.\n\n### References\nhttps://github.com/advisories/GHSA-mhp6-pxh8-r675\nhttps://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\nhttps://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\nhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\nhttps://snyk.io/vuln/SNYK-JS-ANGULAR-570058","status":"published","published":"2020-08-05T21:47:02Z","modified":"2021-10-08T21:25:58Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-m9gf-397r-hwpg","title":"AngularJS allows attackers to bypass common image source restrictions","description":"Improper sanitization of the value of the `[srcset]` attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T15:30:41Z","modified":"2026-09-10T03:50:18.198620721Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"UBUNTU-CVE-2024-8372","description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2024-09-09T15:15:00Z","modified":"2026-02-04T03:48:20.386989Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"CLSA-2026-1773706637","title":"TuxCare security update for angular (11 CVEs)","description":"TuxCare rebuilt angular to address 11 CVEs. Fixed in 1.8.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.685142674Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879502","title":"TuxCare security update for angular (13 CVEs)","description":"TuxCare rebuilt angular to address 13 CVEs. Fixed in 1.4.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.657690559Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773965928","title":"TuxCare security update for angular (3 CVEs)","description":"TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.8.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:00.318284989Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774052344","title":"TuxCare security update for angular (3 CVEs)","description":"TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.7.9-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:00.926720709Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774052347","title":"TuxCare security update for angular (3 CVEs)","description":"TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.6.10-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:46:57.128047116Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774052358","title":"TuxCare security update for angular (3 CVEs)","description":"TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.5.11-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:01.786372177Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1781657707","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.7.9-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.979621536Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781657708","title":"TuxCare security update for angular (1 CVE)","description":"TuxCare rebuilt angular to address 1 CVE. Fixed in 1.6.10-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:32.228330766Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781657709","title":"TuxCare security update for angular (2 CVEs)","description":"TuxCare rebuilt angular to address 2 CVEs. Fixed in 1.5.11-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:31.676968067Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1787822123","title":"TuxCare security update for angular (14 CVEs)","description":"TuxCare rebuilt angular to address 14 CVEs. Fixed in 1.4.7-tuxcare.1.","status":"published","published":"2026-08-27T09:15:23Z","modified":"2026-10-15T09:48:03.127937253Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-4242-1","title":"angular.js - security update","status":"published","published":"2025-07-20T00:00:00Z","modified":"2026-03-09T02:10:45.874056Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"GHSA-28hp-fgcr-2r4h","title":"Cross-Site Scripting via JSONP","description":"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.","status":"published","published":"2019-06-27T17:25:42Z","modified":"2021-02-24T18:32:36Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-CVE-2024-8372","title":"CVE-2024-8372 in angular - Patched by Root","description":"Root has patched CVE-2024-8372 in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:13.941643982Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-28hp-fgcr-2r4h","title":"GHSA-28hp-fgcr-2r4h in angular - Patched by Root","description":"Root has patched GHSA-28hp-fgcr-2r4h in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:12.427027284Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-5cp4-xmrw-59wf","title":"GHSA-5cp4-xmrw-59wf in angular - Patched by Root","description":"Root has patched GHSA-5cp4-xmrw-59wf in the angular package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:31:38Z","modified":"2026-08-04T19:30:15.319898872Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}