Update dependency @angular/common to v20.3.14 [SECURITY]#2585
Open
renovate[bot] wants to merge 1 commit into
Open
Update dependency @angular/common to v20.3.14 [SECURITY]#2585renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
20.1.6→20.3.14Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
CVE-2025-66035 / GHSA-58c5-g7wp-6w37
More information
Details
The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.
Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (
http://orhttps://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to theX-XSRF-TOKENheader.Impact
The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.
Attack Preconditions
POST) to a protocol-relative URL (e.g.,//attacker.com) that they control.Patches
Workarounds
Developers should avoid using protocol-relative URLs (URLs starting with
//) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single/) or fully qualified, trusted absolute URLs.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@angular/common)
v20.3.14Compare Source
http
v20.3.13Compare Source
v20.3.12Compare Source
v20.3.11Compare Source
common
compiler
core
v20.3.10Compare Source
compiler-cli
migrations
v20.3.9Compare Source
v20.3.7Compare Source
animations
Element.animateexceptions (#64506)compiler
compiler-cli
core
router
v20.3.6Compare Source
core
platform-browser
DomEventsPluginshould always be the last plugin to be called forsupports(). (#50394)v20.3.5Compare Source
compiler-cli
core
animate.leavefunction bindings (#64413)migrations
router
v20.3.4Compare Source
core
migrations
v20.3.3Compare Source
compiler
core
migrations
v20.3.2Compare Source
Deprecations
platform-server
@angular/platform-serveris deprecated. Use standardfetchAPIs instead.common
compiler
core
http
platform-server
service-worker
v20.3.1Compare Source
platform-server
v20.3.0Compare Source
Breaking Changes
core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:
After:
A schematic is provided to automatically update
main.server.tsfiles to pass theBootstrapContextto thebootstrapApplicationcall.In addition,
getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively when running in a server environment.(cherry picked from commit
8bf80c9)core
BootstrapContextfor improved server bootstrapping (#63636)v20.2.4Compare Source
core
platform-server
v20.2.3Compare Source
compiler
core
rxResourcestreamthrew before returning anObservable(#63342)v20.2.2Compare Source
compiler
core
@forloop animations never get cancelled (#63328)animate.leavebinding to a string with spaces (#63366)v20.2.1Compare Source
compiler
v20.2.0Compare Source
Deprecations
animations
core
router
animations
compiler
compiler-cli
core
asaliases onelse ifblocks (#63047)animate.enterclass removal when composing classes (#62981)@iftoggles with leave animations (#63048)forms
http
HttpClient(#62586)language-service
platform-browser
router
currentNavigationsignal to theRouterservice. (#62971)service-worker
v20.1.8Compare Source
compiler
| Commit | Type | Description
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.