{"id":"EUVD-2026-117786","enisaUuid":"814b16a4-9e6f-344d-b88e-e1260cafbb7b","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser\u0027s WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim\u0027s XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","datePublished":"Nov 5, 2026, 8:25:07 PM","dateUpdated":"Nov 5, 2026, 8:25:07 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr\nhttps://github.com/angular/angular/issues/71294\nhttps://github.com/angular/angular/pull/65683\nhttps://github.com/angular/angular/pull/71295\nhttps://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b\nhttps://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e\nhttps://github.com/angular/angular/releases/tag/21.0.3\nhttps://github.com/angular/angular/releases/tag/v20.3.34\n","aliases":"CVE-2026-111753\nGHSA-jfgx-762w-99vr\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"42aaf622-d076-38c4-9052-ab8d4667be9b","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"89487616-a897-36dc-bfa8-ceb71f3b8128","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.34"},{"id":"cd060b4d-f9b3-3512-a8f1-ff0ed26949e5","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.0.3"}],"enisaIdVendor":[{"id":"4c1b9143-f77a-3e36-8f74-2e8c9316b861","vendor":{"name":"angular"}}],"enisaIdVulnerability":[{"id":"1ce04a76-dcd7-3738-9f23-eb88f2f71194","vulnerability":{"id":"GHSA-jfgx-762w-99vr","description":"@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","datePublished":"Oct 20, 2026, 8:37:57 PM","dateUpdated":"Oct 20, 2026, 8:37:57 PM","baseScore":0.0,"references":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr\nhttps://github.com/angular/angular/pull/65683\nhttps://github.com/angular/angular/pull/71295\nhttps://github.com/angular/angular/commit/0659d11c854c9c6b886a2e925afef98d70bb005f\nhttps://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b\nhttps://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e\nhttps://github.com/angular/angular\n","enisa_id":"EUVD-2026-117786\n","aliases":"CVE-2026-111753\nGHSA-jfgx-762w-99vr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"664318ea-007a-3997-a72c-9e0c78c19e76","vulnerability":{"id":"CVE-2026-111753","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser\u0027s WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim\u0027s XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","datePublished":"Nov 5, 2026, 8:25:07 PM","dateUpdated":"Nov 5, 2026, 8:25:07 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr\nhttps://github.com/angular/angular/issues/71294\nhttps://github.com/angular/angular/pull/65683\nhttps://github.com/angular/angular/pull/71295\nhttps://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b\nhttps://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e\nhttps://github.com/angular/angular/releases/tag/21.0.3\nhttps://github.com/angular/angular/releases/tag/v20.3.34\n","enisa_id":"EUVD-2026-117786\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Nov 7, 2026, 6:00:44 AM","vulnerabilityProduct":[{"id":"154c3652-4ef2-3e97-a53b-bb616b5b4bcd","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.0.3"},{"id":"cca645ff-c805-337b-ad5f-a2e326f53e94","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.34"},{"id":"f890d579-e244-3926-9672-e2195a27b9b2","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"}],"vulnerabilityVendor":[{"id":"692102e4-367b-31b1-80e1-85589d6c094d","vendor":{"name":"angular"}}]}}],"enisaIdAdvisory":[]}