Threats tagged 'ghsa-hh8m-fm6v-7cvg'

A vulnerability in Angular's @angular/core and @angular/compiler prior to versions 20.3.28, 21.2.20, and 22.1.0 allows sanitization bypass via directive host bindings on certain host elements. The Angular compiler incorrectly determines the security context based on the directive or component selector instead of the actual host element, potentially allowing untrusted inputs such as javascript: URLs to be inserted into DOM attributes without proper sanitization. This can enable Cross-Site Scripting (XSS) attacks. Official patches are available in the specified versions. Users are advised to explicitly sanitize inputs or restrict URL schemes as a workaround.