{"affected":[{"product":"angular","source":"CNA: GitHub_M","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.34"},{"status":"affected","version":">= 21.0.0, < 21.0.3"}]},{"ecosystem":"npm","packageName":"@angular/common","product":"@angular/common","source":"GitHub GHSA-jfgx-762w-99vr","vendor":"","versions":[{"status":"affected","version":">= 21.0.0, < 21.0.3","versionType":"GitHub advisory range"}]},{"ecosystem":"npm","packageName":"@angular/common","product":"@angular/common","source":"GitHub GHSA-jfgx-762w-99vr","vendor":"","versions":[{"status":"affected","version":">= 20.0.0, < 20.3.34","versionType":"GitHub advisory range"}]},{"ecosystem":"npm","packageName":"@angular/common","product":"@angular/common","source":"GitHub GHSA-jfgx-762w-99vr","vendor":"","versions":[{"status":"affected","version":"<= 19.2.25","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@angular/common","product":"@angular/common","source":"OSV GHSA-jfgx-762w-99vr","vendor":"","versions":[{"events":[{"introduced":"21.0.0"},{"fixed":"21.0.3"}],"lessThan":"21.0.3","status":"affected","version":"21.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@angular/common","product":"@angular/common","source":"OSV GHSA-jfgx-762w-99vr","vendor":"","versions":[{"events":[{"introduced":"20.0.0"},{"fixed":"20.3.34"}],"lessThan":"20.3.34","status":"affected","version":"20.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@angular/common","product":"@angular/common","source":"OSV GHSA-jfgx-762w-99vr","vendor":"","versions":[{"events":[{"introduced":"0"},{"last_affected":"19.2.25"}],"lessThanOrEqual":"19.2.25","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-111753","cwes":["CWE-201","CWE-359"],"description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","epss":{"date":"2026-11-09","percentile":0.45538,"score":0.00537},"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.9,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794266231570,"publishedAt":1793910307322,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/issues/71294"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/pull/65683"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/pull/71295"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/releases/tag/21.0.3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular/releases/tag/v20.3.34"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/issues/71294"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/pull/65683"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/pull/71295"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/releases/tag/21.0.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/releases/tag/v20.3.34"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-jfgx-762w-99vr"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-jfgx-762w-99vr"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-jfgx-762w-99vr","text":"@angular/common (npm): GitHub reports patched versions 21.0.3. Check the advisory for the affected release branch.","url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"},{"kind":"fix","source":"GitHub GHSA-jfgx-762w-99vr","text":"@angular/common (npm): GitHub reports patched versions 20.3.34. Check the advisory for the affected release branch.","url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"},{"kind":"fix","source":"OSV GHSA-jfgx-762w-99vr","text":"@angular/common (npm): OSV reports a fixed version 21.0.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jfgx-762w-99vr"},{"kind":"fix","source":"OSV GHSA-jfgx-762w-99vr","text":"@angular/common (npm): OSV reports a fixed version 20.3.34. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jfgx-762w-99vr"}],"revision":"9a54907189348290a3fe3fbe5fe638d2fada095258cf33c10b0b656d5f1101cf","sources":[{"modifiedAt":1794264782853,"name":"CNA: GitHub_M","retrievedAt":1794265714772,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111753"},{"modifiedAt":1794266231570,"name":"NVD","retrievedAt":1794269908541,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111753"},{"modifiedAt":1792430085000,"name":"GitHub Security Advisories","retrievedAt":1794086409548,"url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"},{"modifiedAt":1792529105952,"name":"OSV / GitHub Security Advisories","retrievedAt":1793913738788,"url":"https://osv.dev/vulnerability/GHSA-jfgx-762w-99vr"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794265729257,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111753"}],"ssvc":{"assessedAt":1794264748681,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","updatedAt":1794269908541}