SB2026081844 - Cross-site scripting in Angular

Description

This security bulletin contains information about 1 vulnerability.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in the user's browser context.

The vulnerability exists due to improper neutralization of input during web page generation in directive host bindings in @angular/core and @angular/compiler when applying security-sensitive host bindings to concrete host elements with an incorrect or missing security context. A remote attacker can control the value bound to an affected host binding to execute arbitrary JavaScript in the user's browser context.

User interaction is required to load or render the affected application content.

Remediation

Install update from vendor's website.

References

• https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg
• https://github.com/angular/angular/pull/69558