GHSA-hh8m-fm6v-7cvg

Dashboard / Vulnerabilities / GHSA-hh8m-fm6v-7cvg

GHSA-hh8m-fm6v-7cvg

Summary: Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Details: Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as `href`, `src`, `action`, `xlink:href`, and `data`) to protect against Cross-Site Scripting (XSS). Prior to the fix, the Angular compiler determined the `SecurityContext` for directive host bindings (`host: {'[attr.href]': 'value'}` or `@HostBinding('attr.href')`) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to. When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through: - `hostDirectives` composition, - Class inheritance of host bindings, - Dynamic component instantiation (`createComponent` with custom `hostElement` or dynamic directives), - Elements with SVG/MathML namespaces (e.g. `<svg:a>`, `<math>`), or - Elements using tag-neutral selectors (e.g. `:not(...)`), the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. `javascript:...` URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer. ### Impact An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting). ### Patches This issue has been resolved in versions: - `22.1.0` - `21.2.20` - `20.3.28` ### Workarounds Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using `DomSanitizer.sanitize(SecurityContext.URL, ...)` before assignment, or restrict the input to validated safe URL schemes (e.g. `http://`, `https://`).

References: https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg, https://github.com/angular/angular/issues/69550, https://github.com/angular/angular/pull/69558, https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264, https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee, https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b, https://github.com/angular/angular, https://github.com/angular/angular/releases/tag/v20.3.28, https://github.com/angular/angular/releases/tag/v21.2.20, https://github.com/angular/angular/releases/tag/v22.1.0