Skyzerozx

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 **Description** Angular supports Hydration via `provideClientHydration()` to optimize client-side bootstrap in Server-Side Rendered (SSR) environments. During SSR, the application's runtime state, such as cached `HttpClient` responses, is serialized and output as a `<script>` tag with the predictable identifier `ng-state`. During client bootstrap, Angular recovers this state using `document.getElementById('ng-state')` and parses the content as JSON. This process is susceptible to DOM Clobbering, a technique where an attacker injects an element with a specific ID to override a legitimate DOM element. If an application binds untrusted user input or CMS content to element properties like `id` before the genuine script tag is parsed, the attacker-controlled element takes precedence. This allows an attacker to inject a custom JSON payload into the `TransferState` cache, specifically poisoning the HTTP Transfer Cache. Consequently, `HttpClient` may return a forged response instead of requesting the genuine backend API, potentially leading to DOM-based Cross-Site Scripting (XSS), privilege escalation by spoofing user info, or UI hijacking. **Recommendations** Update to version 22.0.1. Update to version 21.2.17. Update to version 20.3.25. Avoid binding raw user-supplied values or dynamic CMS IDs directly to element attributes; sanitize them or prepend a static safe prefix. Configure a unique, non-predictable `APP ID` in the application configuration to change the state element lookup ID from `ng-state` to a custom value.

**Name of the Vulnerable Software and Affected Versions** @angular/service-worker versions prior to 19.2.23 @angular/service-worker versions prior to 20.3.22 @angular/service-worker versions prior to 21.2.15 @angular/service-worker versions prior to 22.0.0-rc.2 **Description** An issue in the `@angular/service-worker` package compromises request-policy enforcement during request reconstruction. When the service worker intercepts network requests for matched assets, an internal helper function strips explicit client-defined safety parameters, specifically the `credentials` configuration (e.g., `credentials: 'omit'`) and the HTTP `cache` mode configuration (e.g., `cache: 'no-store'`). These are reverted to browser-default parameters, such as `credentials: 'same-origin'`. This behavior causes the browser to include active credentials, like cookies or Authorization headers, in outbound requests where they were explicitly intended to be omitted, potentially leading to session leaks. Furthermore, private or non-cacheable resources may be cached by the service worker engine, allowing private page states to persist in the local cache after a user logs out. **Recommendations** Update to version 19.2.23 or later. Update to version 20.3.22 or later. Update to version 21.2.15 or later. Update to version 22.0.0-rc.2 or later. Apply strict flags to session cookies (`SameSite=Strict; Secure; HttpOnly`) and ensure complete route isolation for credential-guarded secure resources. Exclude patterns targeting dynamic, secure endpoints from automatic asset groups or caching scopes in the `ngsw-config.json` file. Programmatically purge the browser's Cache Storage API entries registered by the Angular Service Worker upon user logout.

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.16 Angular versions prior to 20.3.24 Angular versions prior to 19.2.25 **Description** A Cross-Site Scripting (XSS) issue exists in the DOM emulation dependency `domino` used by `@angular/platform-server` during the serialization of `<noscript>` elements. When using Server-Side Rendering (SSR), `domino` treats `<noscript>` as a raw-text element but fails to include it in the list of elements requiring closing-tag escaping. Consequently, if dynamic text content is rendered inside a `<noscript>` element via template bindings like `{{ value }}` or `[textContent]`, any occurrence of `</noscript>` is not escaped and is serialized directly into the HTML. This allows an attacker to close the `<noscript>` block prematurely and inject a `<script>` block that executes in the user's browser context, potentially leading to session hijacking, credential theft, or unauthorized actions. **Recommendations** Update to version 22.0.0-rc.2. Update to version 21.2.16. Update to version 20.3.24. Update to version 19.2.25. Avoid binding user-controlled values inside `<noscript>` elements. Sanitize user input placed inside `<noscript>` to explicitly strip closing `</noscript>` tags before passing it to the template.

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.22 **Description** An issue in the `@angular/compiler` and `@angular/core` packages allows bypassing element and attribute sanitization and validation through namespace workarounds. The Angular template preparser fails to properly identify namespaced script elements, such as `<svg:script>` or `<:svg:script>`, as script elements, allowing them to pass through template compilation without being stripped. Additionally, security context schema mappings for element attributes do not consistently handle attributes within namespaced elements like SVG and MathML, creating gaps where malicious namespaced attributes can bypass runtime and compile-time sanitizers. These flaws enable an attacker to inject a template or tag structure with custom namespaces to bypass script-stripping logic and attribute sanitizers, resulting in client-side Cross-Site Scripting (XSS), which is the execution of arbitrary JavaScript in the user's browser context. **Recommendations** Update to version 22.0.0-rc.2. Update to version 21.2.15. Update to version 20.3.22. Update to version 19.2.22.

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.23 **Description** An issue in the `@angular/core` package allows bypassing script-execution restrictions during dynamic component creation. The dynamic component instantiation mechanism `createComponent()` failed to reject mounting components directly onto a `<script>` or namespaced script element, such as `<svg:script>`. This allows an attacker who controls the host element or selector parameter passed to `createComponent()` to initialize or mount an Angular component directly onto a script tag, leading to client-side Cross-Site Scripting (XSS) and the execution of untrusted code. This occurs when an application registers dynamic components based on user-supplied parameters without additional input sanitization. **Recommendations** Update to version 22.0.0-rc.2 Update to version 21.2.15 Update to version 20.3.22 Update to version 19.2.23

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 **Description** An issue in the `@angular/compiler` package allows bypassing DOM property sanitization when using two-way property bindings. When a native DOM property requiring sanitization—such as `innerHTML`, `srcdoc`, `src`, `href`, `data`, or `sandbox`—is bound using two-way binding syntax (e.g., `[(innerHTML)]="value"` or `bindon-innerHTML="value"`), the template compiler fails to apply the necessary sanitizer resolution to the `TwoWayProperty` operation. Consequently, these bindings are emitted without the required sanitizer function, unlike one-way bindings which remain protected. This flaw allows an attacker who controls the value of a two-way bound sensitive property to bypass built-in sanitization, potentially leading to client-side Cross-Site Scripting (XSS), where arbitrary JavaScript is executed in the user's browser context. **Recommendations** Update to version 22.0.1. Update to version 21.2.17. Update to version 20.3.25. As a temporary workaround, avoid using two-way data binding syntax on security-sensitive native DOM properties such as `innerHTML`, `srcdoc`, `src`, `href`, `data`, or `sandbox`.