Angular Dynamic Component Instantiation XSS Vulnerability

Vulnerability Overview Title: Dynamic Component Instantiation Mounting Protection Bypass (XSS) Description: An issue was discovered in the package that allows the bypass of script execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism ( ) fails to reject components that are mounted directly onto or namespaced script elements (such as ). This allows custom components to be initialized on tags where scripts are executed, enabling an attacker to hijack or inject script execution hosts. Impact: Any Angular application that registers dynamic components based on user-supplied parameters (such as selectors or host elements) is vulnerable to this security issue. Once exploited, an attacker can mount a dynamic component onto a script tag, bypassing core dynamic component creation security measures to execute arbitrary JavaScript code. This can lead to session hijacking, sensitive data disclosure, or unauthorized actions. Affected Versions Affected Versions: - >= 21.0.0-next.0 = 22.0.0-next.0 = 20.0.0-next.0 = 19.0.0-next.0 < 19.2.22 - <= 18.2.14 Fixed Versions: - 21.2.15 - 22.0.0-rc.2 - 20.3.22 - 19.2.23 - n/a Remediation Patched Versions: - 22.0.0-rc.2 - 21.2.15 - 20.3.22 - 19.2.23 Prerequisites for Attack 1. User-Controlled Host Selection: The application must accept user-controlled input as the selector/host element passed to . 2. Lack of Additional Context Sanitization: The application does not perform separate input sanitization before passing values to the dynamic creation API. References #58689 #68713 Additional Information Severity: Medium (5.3 / 10) CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: Passive - Vulnerable Code: Undefined CVSS v4 Systemic Impact Metrics: - Confidentiality: Low - Integrity: Low - Availability: Low Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Credits Discovered by: SkyZer0x Fix Reviewers: AndrewKushnir, alan-agius4 Other Contributors: josephperrott

Goal Reached Thanks to every supporter — we hit 100%!

Angular Dynamic Component Instantiation XSS Vulnerability

More from this source