Medium severity · published May 26, 2022
CVE-2021-4231
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2
5.4
CVSS
1.2%
EPSS
No
On KEV
Description
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Angular · Angular
11.1.0; 11.1.0; 11.1.0 · source: NVD
AN
Angularjs · Angularjs
before 11.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4231
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4231
Patch
https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09
Third Party Advisory
https://github.com/angular/angular/issues/40136
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902
Third Party Advisory
https://vuldb.com/?id.181356
More from Angular
9.1
CVE-2026-88056
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
8.8
CVE-2026-50178
Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension
8.8
CVE-2026-49241
Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension
8.7
CVE-2026-101895
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
8.2
CVE-2026-101896
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)