CVE-2020-7676: XSS
A XSS flaw was found in nodejs-angular. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "\<option\>" elements in "\<select\>" ones changes parsing behavior, leading to possibly unsanitizing code.
Other sources
angular.js is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7676?
CVE-2020-7676 is a cross-site scripting vulnerability in nodejs-angular, which allows remote attackers to inject malicious script into a web page.
How does CVE-2020-7676 affect angular.js?
CVE-2020-7676 affects angular.js by allowing remote attackers to inject malicious script into a web page.
What is the severity of CVE-2020-7676?
The severity of CVE-2020-7676 is medium (5.4).
How can I fix CVE-2020-7676?
To fix CVE-2020-7676, update to the latest version of nodejs-angular.
Where can I find more information about CVE-2020-7676?
You can find more information about CVE-2020-7676 on the NIST National Vulnerability Database (NVD) website and the GitHub repository for angular.js.