Описание
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a ). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a
Отчет
Red Hat has evaluated this vulnerability and determined that most products listed as shipping @angular/core in their SBOMs are not affected. The majority of flagged components (firefox, thunderbird, mozjs, gjs, intel-cmt-cat, syncthing, ceph, and others) either do not use the Angular framework at all (technology mismatch — these are C++/Rust/Go applications), use the unrelated AngularJS 1.x framework (which lacks the createComponent API), or have the Angular frontend excluded from the productized build (e.g., Ceph RPMs build with -DWITH_MGR_DASHBOARD_FRONTEND:BOOL=OFF). The createComponent API that this vulnerability targets is specific to @angular/core version 2+ and is not reachable in these components.
Меры по смягчению последствий
Users of applications built with @angular/core versions prior to 19.2.23, 20.3.22, 21.2.15, or 22.0.0-rc.2 should upgrade to the fixed versions. Applications that do not use the createComponent API with user-controlled host element parameters are not exploitable.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-operator-bundle | Fix deferred | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-rhel9 | Fix deferred | ||
| Red Hat build of Apicurio Registry 3 | apicurio/apicurio-registry-ui-rhel8 | Not affected | ||
| Red Hat build of Apicurio Registry 3 | apicurio/apicurio-registry-ui-rhel9 | Not affected | ||
| Red Hat Ceph Storage 4 | ceph | Not affected | ||
| Red Hat Enterprise Linux 10 | ceph | Not affected | ||
| Red Hat Enterprise Linux 10 | firefox | Not affected | ||
| Red Hat Enterprise Linux 10 | gjs | Not affected | ||
| Red Hat Enterprise Linux 10 | intel-cmt-cat | Not affected | ||
| Red Hat Enterprise Linux 10 | thunderbird | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Angular is a development platform for building mobile and desktop web ...
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
EPSS
6.8 Medium
CVSS3