CVE-2020-7676: Cross-Site Scripting in Angular
Summary
CVE-2020-7676: Cross site scripting in Angular. Affects angular versions < 1.8.0. Fixed in 1.8.0. How to fix ↓
Also tracked for
- angular.js · Debian:11
The same CVE-2020-7676 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Angular is a popular JavaScript framework used for building web applications. It provides a comprehensive set of features for creating dynamic and interactive user interfaces. However, versions of Angular prior to 1.8.0 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability arises from the regex-based input HTML replacement, which can inadvertently convert sanitized code into unsanitized code. Specifically, when wrapping '<option>' elements within '<select>' elements, the parsing behavior changes, potentially leading to the unsanitization of code.
Vulnerability Detail
The cross-site scripting vulnerability in Angular allows an attacker to inject malicious code into a web application. By exploiting this vulnerability, an attacker can execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various security risks, such as stealing sensitive user information, manipulating web content, or performing actions on behalf of the user. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 1.8.3 as of 23 Oct 2026
npm install angular@1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.0
This is the first release that contains the fix.
npm install angular@1.8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Angular is not immediately feasible, a temporary workaround can be applied. Developers can manually sanitize user input and ensure that all input HTML is properly escaped or encoded before rendering it in the web application. This can be achieved using appropriate sanitization libraries or frameworks. Here's an example of how to sanitize user input in Angular:
import { DomSanitizer } from '@angular/platform-browser';
constructor(private sanitizer: DomSanitizer) {}
sanitizeInput(input: string): string {
return this.sanitizer.sanitize(SecurityContext.HTML, input);
}
Conclusion
The cross-site scripting vulnerability in Angular (CVE-2020-7676) poses a moderate security risk. To mitigate this vulnerability, it is crucial to upgrade to Angular version 1.8.0 or later. Additionally, developers can apply manual sanitization techniques to ensure the security of user input. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for angular →
FAQ
Angular is a JavaScript framework for building web applications. It provides a range of features and tools to simplify the development of dynamic and interactive user interfaces.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or manipulating web content.
The XSS vulnerability in Angular arises from the regex-based input HTML replacement. When wrapping '<option>' elements within '<select>' elements, the parsing behavior changes, potentially leading to the unsanitization of code.
The XSS vulnerability in Angular can allow attackers to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various security risks, such as stealing sensitive user information, manipulating web content, or performing actions on behalf of the user.
To fix the XSS vulnerability in Angular, it is recommended to upgrade to version 1.8.0 or later. This version includes proper sanitization mechanisms to prevent the unsanitization of code. Alternatively, you can manually sanitize user input and ensure proper escaping or encoding before rendering it in the web application.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
