Google Angularjs vulnerabilities

CVE-2026-11998 [HIGH] CWE-791 CVE-2026-11998: A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies fo A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, incl

CVE-2025-0716 [MEDIUM] CWE-791 CVE-2025-0716: Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elemen Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too

CVE-2025-2336 [MEDIUM] CWE-791 CVE-2025-2336: Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elemen Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and

CVE-2024-8373 [MEDIUM] CWE-791 CVE-2024-8373: Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS Improper sanitization of the value of the [srcset] attribute in HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life an

CVE-2024-8372 [MEDIUM] CWE-1289 CVE-2024-8372: Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life a

CVE-2025-4690 [MEDIUM] CWE-1333 CVE-2025-4690: A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/link A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expressi