Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-g6uy-ey69-93b8
Vulnerability ID VCID-g6uy-ey69-93b8
Aliases CVE-2022-25869
GHSA-prc3-vjfx-vhm9
Summary All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25869.json
epss 0.04265 https://api.first.org/data/v1/epss?cve=CVE-2022-25869
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-prc3-vjfx-vhm9
cvssv3.1 6.1 https://glitch.com/edit/%23%21/angular-repro-textarea-xss
generic_textual MODERATE https://glitch.com/edit/%23%21/angular-repro-textarea-xss
cvssv3.1 6.1 https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869
generic_textual MODERATE https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2022-25869
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-25869
cvssv3.1 6.1 https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617
generic_textual MODERATE https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617
cvssv3.1 6.1 https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031
generic_textual MODERATE https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031
cvssv3.1 6.1 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
generic_textual MODERATE https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
cvssv3.1 6.1 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
generic_textual MODERATE https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
cvssv3.1 6.1 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
generic_textual MODERATE https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
cvssv3.1 6.1 https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
generic_textual MODERATE https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
cvssv3.1 6.1 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
generic_textual MODERATE https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
cvssv3.1 6.1 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
generic_textual MODERATE https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
cvssv3.1 6.1 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
generic_textual MODERATE https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
cvssv3.1 6.1 https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781
generic_textual MODERATE https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781
cvssv3.1 6.1 https://www.npmjs.com/package/angular
generic_textual MODERATE https://www.npmjs.com/package/angular
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25869.json
https://api.first.org/data/v1/epss?cve=CVE-2022-25869
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25869
https://glitch.com/edit/%23%21/angular-repro-textarea-xss
https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869
https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617
https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781
https://www.npmjs.com/package/angular
1036694 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036694
2362768 https://bugzilla.redhat.com/show_bug.cgi?id=2362768
CVE-2022-25869 https://nvd.nist.gov/vuln/detail/CVE-2022-25869
GHSA-prc3-vjfx-vhm9 https://github.com/advisories/GHSA-prc3-vjfx-vhm9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25869.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://glitch.com/edit/%23%21/angular-repro-textarea-xss
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-25869
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.npmjs.com/package/angular
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.89069
EPSS Score 0.04265
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:29:12.913314+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0