CVE-2021-4231

MEDIUM5.4EPSS 1.2%

Angular vulnerable to Cross-site Scripting

Published: 5/27/2022Modified: 2/4/2026

Also known as:GHSA-c75v-2vq8-878fCGA-9x5w-x8wq-mxhq

Description

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.

Affected packages (1)

npm/@angular/core>= 11.0.0, < 11.0.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-4231
PATCHhttps://github.com/angular/angular
WEBhttps://github.com/angular/angular/commit/0aa220bc0000fc4d1651ec388975bbf5baa1da36
WEBhttps://github.com/angular/angular/commit/47d9b6d72dab9d60c96bc1c3604219f6385649ea
WEBhttps://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09
WEBhttps://github.com/angular/angular/issues/40136
WEBhttps://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902
WEBhttps://vuldb.com/?id.181356