{"id":"CVE-2026-111753","published":"2026-11-05T21:18:35.800","lastModified":"2026-11-05T21:18:35.800","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-201","CWE-359"],"vendors":[],"products":[],"references":[{"url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b","tags":[]},{"url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e","tags":[]},{"url":"https://github.com/angular/angular/issues/71294","tags":[]},{"url":"https://github.com/angular/angular/pull/65683","tags":[]},{"url":"https://github.com/angular/angular/pull/71295","tags":[]},{"url":"https://github.com/angular/angular/releases/tag/21.0.3","tags":[]},{"url":"https://github.com/angular/angular/releases/tag/v20.3.34","tags":[]},{"url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr","tags":[]}],"exploitRefs":[{"url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b","tags":[]},{"url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e","tags":[]},{"url":"https://github.com/angular/angular/issues/71294","tags":[]},{"url":"https://github.com/angular/angular/pull/65683","tags":[]},{"url":"https://github.com/angular/angular/pull/71295","tags":[]},{"url":"https://github.com/angular/angular/releases/tag/21.0.3","tags":[]},{"url":"https://github.com/angular/angular/releases/tag/v20.3.34","tags":[]},{"url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr","tags":[]}],"hasPoc":true,"ai":null}