CVE-2024-8372: AngularJS allows attackers to bypass common image source restrictions
(updated )
Improper sanitization of the value of the [srcset] attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects AngularJS versions 1.3.0-rc.4 and greater.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
References
- codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017
- github.com/advisories/GHSA-m9gf-397r-hwpg
- github.com/angular/angular.js
- lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- nvd.nist.gov/vuln/detail/CVE-2024-8372
- security.netapp.com/advisory/ntap-20241122-0002
- www.herodevs.com/vulnerability-directory/cve-2024-8372
Code Behaviors & Features
Detect and mitigate CVE-2024-8372 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →