Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
angular angular
>= 22.0.0-next.0, < 22.0.1affected>= 21.0.0-next.0, < 21.2.19affected< 20.3.27affected
@angular compiler
>= 22.0.0-next.0, < 22.0.1affected>= 21.0.0-next.0, < 21.2.19affected< 20.3.27affected
@angular core
>= 22.0.0-next.0, < 22.0.1affected>= 21.0.0-next.0, < 21.2.19affected< 20.3.27affected
References
- https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99 ↗
- https://github.com/angular/angular/pull/68821 ↗
- https://github.com/angular/angular/pull/69306 ↗
- https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e ↗
- https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865 ↗