Exposure of Private Personal Information to an Unauthorized Actor Affecting @angular/common package, versions <20.3.34>=21.0.0 <21.0.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ANGULARCOMMON-21369526
- published21 Oct 2026
- disclosed20 Oct 2026
- creditJaime Burgos
Introduced: 20 Oct 2026
NewCVE-2026-111753 (opens in a new tab)How to fix?
Upgrade @angular/common to version 20.3.34, 21.0.3 or higher.
Overview
Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the xsrfInterceptorFn in packages/common/http/src/xsrf.ts, where the XSRF interceptor skips token injection for all absolute URLs, including those that share the same origin as the application. An attacker can exploit this gap to perform state-changing requests from a victim's browser without a valid XSRF token, bypassing the intended cross-site request forgery protection. This affects any mutating HTTP request (non-GET, non-HEAD) made using an absolute URL rather than a relative one.
Note: This is only exploitable when the application makes mutating requests using absolute URLs to the same origin, and XSRF protection is enabled (the default in HttpClient).