PT-2026-49568 · Google · Angular
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Angular versions prior to 22.0.0-rc.2
Angular versions prior to 21.2.15
Angular versions prior to 20.3.22
Angular versions prior to 19.2.23
Description
An issue in the
@angular/core package allows bypassing script-execution restrictions during dynamic component creation. The dynamic component instantiation mechanism createComponent() failed to reject mounting components directly onto a <script> or namespaced script element, such as <svg:script>. This allows an attacker who controls the host element or selector parameter passed to createComponent() to initialize or mount an Angular component directly onto a script tag, leading to client-side Cross-Site Scripting (XSS) and the execution of untrusted code. This occurs when an application registers dynamic components based on user-supplied parameters without additional input sanitization.Recommendations
Update to version 22.0.0-rc.2
Update to version 21.2.15
Update to version 20.3.22
Update to version 19.2.23
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Angular