Critical Unauthenticated Remote Code Execution in angular-base64-upload
Summary
CVE-2024-42640: angular-base64-upload vulnerable to unauthenticated remote code execution. Affects angular-base64-upload versions < 0.1.21. Fixed in 0.1.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
angular-base64-upload is an npm package that facilitates the upload of base64-encoded files in Angular applications. It provides a simple interface for handling file uploads, making it easier for developers to integrate file upload functionality into their projects. However, versions prior to v0.1.21 are susceptible to a critical vulnerability that allows for unauthenticated remote code execution, posing a significant risk to applications using this package.
Vulnerability Detail
The vulnerability arises from the angular-base64-upload/demo/server.php endpoint, which allows attackers to upload arbitrary file content without authentication. Once the malicious file is uploaded, it can be accessed through the angular-base64-upload/demo/uploads endpoint, leading to the execution of the uploaded content on the server. This vulnerability can result in complete server compromise, allowing attackers to execute arbitrary code. The issue is classified under CWE-434, which pertains to the unrestricted upload of files.
How To Fix
Latest published version: 0.1.23 as of 23 Oct 2026
npm install angular-base64-upload@0.1.23Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.21
This is the first release that contains the fix.
npm install angular-base64-upload@0.1.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the file upload functionality or restrict access to the upload endpoint until the package is updated. Additionally, consider implementing server-side validation to ensure that only safe file types are accepted.
Conclusion
The angular-base64-upload package has a critical vulnerability that allows for unauthenticated remote code execution in versions prior to 0.1.21. It is essential for developers using this package to update to the latest version to protect their applications from potential exploitation. Implementing workarounds and monitoring for suspicious activity can help mitigate risks until the update is applied.
See every vulnerability recorded for angular-base64-upload →
FAQ
The vulnerability has a CVSS score of 10.0, indicating it is critical and poses a severe risk to affected systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, an attacker could execute arbitrary code on the server, leading to data breaches, unauthorized access, and potential complete server takeover.
Yes, you can temporarily disable the upload functionality or restrict access to the upload endpoint while you prepare to update the package.
If immediate updates are not possible, implement strict server-side validation for file uploads and monitor your application for any suspicious activity.
