AngularJS vulnerabilitiesAngularJS: known vulnerabilities and safe versions
npm: angular
AngularJS has 22 known vulnerability records: 13 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 9 only in Retire.js (CDN builds and advisories without a CVE). The latest release is 1.8.3 (endoflife.date).
By branch: 1.8.x has no fixed release in the records; 1.7.x has no fixed release in the records; 1.6.x has no fixed release in the records; 1.5.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 1.8.x | Ended (December 31, 2021) | 1.8.3 | 12high | No fix |
| 1.7.x | Ended (December 31, 2021) | 1.7.9 | 15high | No fix |
| 1.6.x | Ended (December 31, 2021) | 1.6.10 | 17high | No fix |
| 1.5.x | Ended (December 31, 2021) | 1.5.11 | 18high | No fix |
| 1.4.x | Ended (December 31, 2021) | 1.4.14 | 19high | No fix |
| 1.3.x | Ended (December 31, 2021) | 1.3.20 | 19high | No fix |
| 1.2.x | Ended (December 31, 2021) | 1.2.32 | 16high | No fix |
| 1.1.x | Ended (December 31, 2021) | 1.1.5 | 15high | No fix |
| 1.0.x | Ended (December 31, 2021) | 1.0.8 | 15high | No fix |
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2026-119982026-06-24
AngularJS XSS via SCE resource URL sanitization bypass
Affected versions: >= 1.2.0-rc.3, <= 1.8.3 · >= 1.2.0-rc.3, < 1.8.4
high 7.6
Fixed in: 1.8.4
medium 4.3
Fixed in: 1.9.9
CVE-2025-23362025-06-04
AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'
Affected versions: >= 1.3.1, < 1.8.4
medium 4.8
Fixed in: 1.8.4
CVE-2025-07162025-04-29
AngularJS improper sanitization in SVG '<image>' element
Affected versions: <= 1.8.3 · < 1.8.4
medium 4.8
Fixed in: 1.8.4
CVE-2024-83732024-09-09
AngularJS improper sanitization in '<source>' element
Affected versions: <= 1.8.3 · < 1.8.4
medium 4.3
Fixed in: 1.8.4
CVE-2024-83722024-09-09
AngularJS improper sanitization in 'srcset' attribute
Affected versions: >= 1.3.0-rc.4, <= 1.8.3 · >= 1.3.0-rc.4, < 1.8.4
medium 4.3
Fixed in: 1.8.4
CVE-2024-21490exploit code exists2024-02-10
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.
Affected versions: >= 1.3.0, <= 1.8.3 · >= 1.3.0, < 1.8.4
high 7.5
Fixed in: 1.8.4
EPSS 1.8%
CVE-2023-261182023-03-30
Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element
Affected versions: <= 1.8.3 · < 1.8.4
medium 5.3
Fixed in: 1.8.4
EPSS 1.6%
CVE-2023-261172023-03-30
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to t
Affected versions: <= 1.8.3 · < 1.8.4
medium 5.3
Fixed in: 1.8.4
EPSS 1.6%
CVE-2023-261162023-03-30
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility fu
Affected versions: <= 1.8.3 · < 1.8.4
medium 5.3
Fixed in: 1.8.4
EPSS 1.6%
CVE-2022-25869exploit code exists2022-07-15
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cro
Affected versions: <= 1.8.3 · < 1.8.4
medium 6.1
Fixed in: 1.8.4
EPSS 7.6%
CVE-2022-258442022-05-01
Regular Expression Denial of Service (ReDoS)
Affected versions: >= 1.7.0 · >= 1.7.0, <= 999.x
high 7.5
EPSS 4.9%
CVE-2020-76762020-06-08
angular.js prior to 1.8.0 allows cross site scripting.
Affected versions: < 1.8.0
medium 5.4
Fixed in: 1.8.0
EPSS 1.9%
CVE-2019-148632020-01-02
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appli
Affected versions: < 1.5.0-beta.1
medium 6.1
Fixed in: 1.5.0-beta.1
EPSS 1.1%
CVE-2019-107682019-11-19
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto
Affected versions: < 1.7.9
high 7.5
Fixed in: 1.7.9
EPSS 1.9%
no CVE
XSS through SVG if enableSvg is set
Affected versions: >= 1.5.0, < 1.6.9
low
Fixed in: 1.6.9
no CVE
XSS in $sanitize in Safari/Firefox
Affected versions: < 1.6.5
low
Fixed in: 1.6.5
no CVE
DOS in $sanitize
Affected versions: < 1.6.3
medium
Fixed in: 1.6.3
no CVE
The attribute usemap can be used as a security exploit
Affected versions: >= 1.3.0, < 1.5.0-rc2
medium
Fixed in: 1.5.0-rc2
no CVE
The attribute usemap can be used as a security exploit
Affected versions: >= 1.0.0, < 1.2.30
medium
Fixed in: 1.2.30
medium
Fixed in: 1.8.0
medium
Fixed in: 1.6.0
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 22, 2026.