GHSA-jrmj-c5cx-3cw6
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
@angular/compiler📦@angular/core📦@angular/compiler📦@angular/core📦@angular/compiler📦@angular/core📦@angular/compiler📦@angular/core+2 moreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
- Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
- Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
- Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
- The victim application must explicitly use SVG
<script>elements within its templates. - The application must use property or attribute binding (interpolation) for the
hreforxlink:hrefattributes of those SVG scripts. - The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
- 19.2.18
- 20.3.16
- 21.0.7
- 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
- Avoid Dynamic Bindings: Do not use Angular template binding (e.g.,
[attr.href]) for SVG<script>elements. - Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @angular/compiler | ≥ 21.1.0-next.0&&< 21.1.0-rc.0 | 21.1.0-rc.0 |
| 📦npm | @angular/core | ≥ 21.1.0-next.0&&< 21.1.0-rc.0 | 21.1.0-rc.0 |
| 📦npm | @angular/compiler | ≥ 21.0.0-next.0&&< 21.0.7 | 21.0.7 |
| 📦npm | @angular/core | ≥ 21.0.0-next.0&&< 21.0.7 | 21.0.7 |
| 📦npm | @angular/compiler | ≥ 20.0.0-next.0&&< 20.3.16 | 20.3.16 |
| 📦npm | @angular/core | ≥ 20.0.0-next.0&&< 20.3.16 | 20.3.16 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @angular/compiler. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @angular/compiler to 21.1.0-rc.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jrmj-c5cx-3cw6 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-jrmj-c5cx-3cw6 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-jrmj-c5cx-3cw6. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-jrmj-c5cx-3cw6 in your dependencies?
O3 detects GHSA-jrmj-c5cx-3cw6 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.