CVE-2019-14863: AngularJS Cross-site Scripting Vulnerability
Summary
CVE-2019-14863: AngularJS Cross-site Scripting due to failure to sanitize xlink.href attributes. Affects angular versions < 1.5.0-beta.1. Fixed in 1.5.0-beta.1. How to fix ↓
Also tracked for
- angular.js · Debian:11
The same CVE-2019-14863 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AngularJS is a popular JavaScript framework used for building dynamic web applications. It provides a robust set of features for creating interactive user interfaces. However, versions of the 'angular' package prior to 1.5.0-beta.1 are vulnerable to a Cross-Site Scripting (XSS) attack. This vulnerability arises from the package's failure to properly sanitize 'xlink:href' attributes, which can allow attackers to execute arbitrary JavaScript code in a victim's browser if the value is controlled by the user.
Vulnerability Detail
The vulnerability in the 'angular' package allows for the injection of malicious JavaScript code into web pages. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and the manipulation of user interactions. The lack of proper sanitization of 'xlink:href' attributes makes it possible for attackers to exploit this vulnerability and execute arbitrary code in the context of the victim's browser. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Latest published version: 1.8.3 as of 23 Oct 2026
npm install angular@1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0-beta.1
This is the first release that contains the fix.
npm install angular@1.5.0-beta.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to a fixed version of the 'angular' package.
Conclusion
The 'angular' package prior to version 1.5.0-beta.1 is vulnerable to a Cross-Site Scripting (XSS) attack due to the failure to properly sanitize 'xlink:href' attributes. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of the package. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for angular →
FAQ
This vulnerability allows attackers to execute arbitrary JavaScript code in a victim's browser, potentially leading to unauthorized access to sensitive information and other security risks.
Versions prior to 1.5.0-beta.1 of the 'angular' package are vulnerable to this Cross-Site Scripting (XSS) issue.
While there may not be a specific known exploit for this vulnerability, the lack of proper sanitization of 'xlink:href' attributes can be leveraged by attackers to execute arbitrary JavaScript code.
The recommended mitigation is to upgrade to a fixed version of the 'angular' package that includes the necessary sanitization measures.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
