CVE-2024-8373: AngularJS allows attackers to bypass common image source restrictions
(updated )
Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects all versions of AngularJS.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
References
- codepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b
- github.com/advisories/GHSA-mqm9-c95h-x2p6
- github.com/angular/angular.js
- lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- nvd.nist.gov/vuln/detail/CVE-2024-8373
- security.netapp.com/advisory/ntap-20241122-0003
- www.herodevs.com/vulnerability-directory/cve-2024-8373
Code Behaviors & Features
Detect and mitigate CVE-2024-8373 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →