{"id":"GHSA-r3hf-q8q7-fv2p","aliases":[],"status":"published","title":"Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory","description":"### Impact\nAngular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) attack where an attacker can trick another user into visiting a page which injects malicious JavaScript.\n\nAngular CLI applications without Universal do perform critical CSS inlining as well, however exploiting this requires a malicious actor to already have access to modify source code directly.\n\n### Patches\n`@nguniversal/common` should be upgraded to 16.1.2 or higher. 16.2.0-rc.0 is safe.\n\n### Workarounds\nThe easiest solution is likely to upgrade Universal to 16.1.2 or downgrade to 16.0.x or lower. Alternatively you can [override](https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides) specifically the `critters` dependency with version `0.0.20` in your `package.json`.\n\n```json\n{\n  \"overrides\": {\n    \"critters\": \"0.0.20\"\n  }\n}\n```\n\n### References\n\n* [Angular Blog Post](https://blog.angular.io/notice-of-xss-issue-affecting-angular-universal-16-1-0-16-1-1-95dbae068f)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-08-09T12:51:51Z","modified":"2023-08-18T05:03:14Z","fixes":[{"ecosystem":"npm","package":"@nguniversal/common","fixed_in":["16.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@nguniversal/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0"},{"fixed":"16.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@nguniversal/common","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0"},{"fixed":"16.1.2"}]}]}],"references":[{"url":"https://github.com/angular/universal/security/advisories/GHSA-r3hf-q8q7-fv2p","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r3hf-q8q7-fv2p"},{"url":"https://github.com/angular/universal","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-r3hf-q8q7-fv2p","title":"Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory","description":"### Impact\nAngular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) attack where an attacker can trick another user into visiting a page which injects malicious JavaScript.\n\nAngular CLI applications without Universal do perform critical CSS inlining as well, however exploiting this requires a malicious actor to already have access to modify source code directly.\n\n### Patches\n`@nguniversal/common` should be upgraded to 16.1.2 or higher. 16.2.0-rc.0 is safe.\n\n### Workarounds\nThe easiest solution is likely to upgrade Universal to 16.1.2 or downgrade to 16.0.x or lower. Alternatively you can [override](https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides) specifically the `critters` dependency with version `0.0.20` in your `package.json`.\n\n```json\n{\n  \"overrides\": {\n    \"critters\": \"0.0.20\"\n  }\n}\n```\n\n### References\n\n* [Angular Blog Post](https://blog.angular.io/notice-of-xss-issue-affecting-angular-universal-16-1-0-16-1-1-95dbae068f)","status":"published","published":"2023-08-09T12:51:51Z","modified":"2023-08-18T05:03:14Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"osv":[{"id":"GHSA-r3hf-q8q7-fv2p","title":"Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory","description":"### Impact\nAngular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) attack where an attacker can trick another user into visiting a page which injects malicious JavaScript.\n\nAngular CLI applications without Universal do perform critical CSS inlining as well, however exploiting this requires a malicious actor to already have access to modify source code directly.\n\n### Patches\n`@nguniversal/common` should be upgraded to 16.1.2 or higher. 16.2.0-rc.0 is safe.\n\n### Workarounds\nThe easiest solution is likely to upgrade Universal to 16.1.2 or downgrade to 16.0.x or lower. Alternatively you can [override](https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides) specifically the `critters` dependency with version `0.0.20` in your `package.json`.\n\n```json\n{\n  \"overrides\": {\n    \"critters\": \"0.0.20\"\n  }\n}\n```\n\n### References\n\n* [Angular Blog Post](https://blog.angular.io/notice-of-xss-issue-affecting-angular-universal-16-1-0-16-1-1-95dbae068f)","status":"published","published":"2023-08-09T12:51:51Z","modified":"2023-08-09T12:51:51Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}