CVE-2026-111753
Dashboard / Vulnerabilities / CVE-2026-111753
Summary: Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
Details: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.
References: https://github.com/angular/angular/releases/tag/21.0.3, https://github.com/angular/angular/releases/tag/v20.3.34, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111753.json, https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr, https://nvd.nist.gov/vuln/detail/CVE-2026-111753, https://github.com/angular/angular/issues/71294, https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b, https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e, https://github.com/angular/angular/pull/65683, https://github.com/angular/angular/pull/71295
Affected packages
Package
Name:
Purl:
Affected ranges
Type: GIT
Events:
