CVE-2021-4231: Cross-Site Scripting in Angular
Summary
CVE-2021-4231: Cross site scripting in Angular. Affects @angular/core across 3 version ranges.
< 10.2.5
>= 11.0.0, < 11.0.5
>= 11.1.0-next.0, < 11.1.0-next.3
Fixed in 10.2.5, 11.0.5 or 11.1.0-next.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Angular is an open-source web application framework developed by Google. It is widely used for building dynamic and responsive single-page applications. The @angular/core package is a core component of Angular that provides essential functionality for Angular applications. Unfortunately, a vulnerability has been discovered in versions up to 11.0.4/11.1.0-next.2 of @angular/core, which allows for cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Angular's handling of comments can be exploited to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various security risks, such as stealing sensitive information, manipulating user sessions, or performing actions on behalf of the user. The attack can be launched remotely, but authentication may be required in some cases. The severity of this vulnerability is classified as moderate, with a CVSS score of 5.4.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/core@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 10.2.510.2.5npm install @angular/core@10.2.5 -
>= 11.0.0, < 11.0.511.0.5npm install @angular/core@11.0.5 -
>= 11.1.0-next.0, < 11.1.0-next.311.1.0-next.3npm install @angular/core@11.1.0-next.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions as soon as possible to mitigate the risk of XSS attacks.
Conclusion
Upgrading to the fixed versions of @angular/core (11.0.5 or 11.1.0-next.3) is crucial to protect your application from potential cross-site scripting attacks. It is recommended to apply the patch provided and follow best practices for secure coding to minimize the risk of similar vulnerabilities in the future. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @angular/core →
FAQ
Angular is an open-source web application framework developed by Google. It is used for building dynamic and responsive single-page applications.
@angular/core is a core component of Angular that provides essential functionality for Angular applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can be exploited by injecting malicious JavaScript code into comments, which will be executed in the context of a user's browser when the comment is rendered.
The severity of this vulnerability is classified as moderate, with a CVSS score of 5.4.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
