VDB
Sign up
MEDIUM5.4

GHSA-c75v-2vq8-878f

Angular vulnerable to Cross-site Scripting

Quick fix

GHSA-c75v-2vq8-878f — @angular/core: upgrade to the fixed version with the command below.

npm install @angular/core@11.0.5

Details

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@angular/core
Introduced in: 11.0.0Fixed in: 11.0.5
Fixnpm install @angular/core@11.0.5
npm/@angular/core
Introduced in: 11.1.0-next.0Fixed in: 11.1.0-next.3
Fixnpm install @angular/core@11.1.0-next.3
npm/@angular/core
Introduced in: 0Fixed in: 10.2.5
Fixnpm install @angular/core@10.2.5

References