Client-side template injection
Summary: Client-side template injection occurs when applications using a client-side template framework such as AngularJS dynamically embed user input in web pages, and the framework executes any template expressions it finds, letting an attacker supply a malicious expression that launches XSS. AngularJS's sandbox, which blocked access to objects like window and document, was bypassed repeatedly by researchers through techniques such as overwriting charAt() to fool the isIdent() function, and was eventually removed in version 1.6, though legacy applications on older versions remain vulnerable.
Key Takeaway: The sandbox the developer community treated as a security boundary was removed from AngularJS in version 1.6, and PortSwigger Research broke it comprehensively multiple times before that - so any legacy application still running an older AngularJS version carries an XSS exposure its owners may believe was closed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026