Packages / @angular/core / Security

ModerateVulnerabilityGHSA-c75v-2vq8-878fCVE-2021-4231Published 27 May 2022

Angular vulnerable to Cross-site Scripting

Affected releases · @angular/core

  • 11.x11.0.0 – 11.0.4Fixed in 11.0.5
  • 10.x10.0.0 – 10.2.4Fixed in 10.2.5
  • 9.x and older2.0.0 – 9.1.13No fix, no longer updated

On 11.x, the newest line:

npm install @angular/core@11.0.5
22.x

  1. Not affected

    22.0.0 – 22.2.3

    22 releases, latest

11.x

  1. Affected

    11.0.0 – 11.0.4

    5 releases

  2. Fixed

    11.0.5 – 11.2.14

    23 releases

10.x

  1. Affected

    10.0.0 – 10.2.4

    27 releases

  2. Fixed

    10.2.5

    1 release

9.x

  1. Affected

    9.0.0 – 9.1.13

    22 releases

8.x

  1. Affected

    8.0.0 – 8.2.14

    23 releases

7.x

  1. Affected

    7.0.0 – 7.2.16

    27 releases

6.x

  1. Affected

    6.0.0 – 6.1.10

    20 releases

5.x

  1. Affected

    5.0.0 – 5.2.11

    22 releases

4.x

  1. Affected

    4.0.0 – 4.4.7

    30 releases

2.x

  1. Affected

    2.0.0 – 2.4.10

    24 releases

587 stable releases of @angular/core, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/core. It is read in your browser and sent nowhere.

What happens

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.