AngularJS, end of life since 31 December 2021
AngularJS 1.5.11 vulnerabilities
AngularJS 1.5.11. The OSV open-source vulnerability database lists 13 vulnerabilities for this version, none of them critical. AngularJS gets no more fixes from Google.
- 13known vulnerabilities
- 0critical
- 3high
- 0exploited in the wild
What you can do
Keep AngularJS 1.5.11, patched
We backport the security fixes to the AngularJS version your application loads, tested against your pages before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Rewrite the application in a supported framework, which usually takes months. Our fixes keep it safe in the meantime.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 13 known vulnerabilities in AngularJS 1.5.11
OSV.dev, the open-source vulnerability database used by GitHub and Google, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where OSV records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2026-11998 | 7.6 | High | 2026-06-24 | n/a | Angular's deprecated package has a Cross-Site Scripting issue |
| CVE-2019-10768 | 7.5 | High | 2019-11-20 | 1.7.9 | angular Prototype Pollution vulnerability |
| CVE-2024-21490 | 7.5 | High | 2024-02-10 | n/a | angular vulnerable to super-linear runtime due to backtracking |
| CVE-2022-25869 | 6.1 | Medium | 2022-07-16 | n/a | Angular (deprecated package) Cross-site Scripting |
| CVE-2020-7676 | 5.4 | Medium | 2020-06-18 | 1.8.0 | Angular vulnerable to Cross-site Scripting |
| CVE-2023-26116 | 5.3 | Medium | 2023-03-30 | n/a | angular vulnerable to regular expression denial of service via the angular.copy() utility |
| CVE-2023-26117 | 5.3 | Medium | 2023-03-30 | n/a | angular vulnerable to regular expression denial of service via the $resource service |
| CVE-2023-26118 | 5.3 | Medium | 2023-03-30 | n/a | angular vulnerable to regular expression denial of service via the <input type="url"> element |
| GHSA-5cp4-xmrw-59wf | 5.0 | Medium | 2020-08-05 | 1.8.0 | XSS via JQLite DOM manipulation functions in AngularJS |
| CVE-2024-8372 | 4.8 | Medium | 2024-09-09 | n/a | AngularJS allows attackers to bypass common image source restrictions |
| CVE-2024-8373 | 4.8 | Medium | 2024-09-09 | n/a | AngularJS allows attackers to bypass common image source restrictions |
| CVE-2025-0716 | 4.8 | Medium | 2025-04-29 | n/a | AngularJS improperly sanitizes SVG elements |
| GHSA-28hp-fgcr-2r4h | n/a | Medium | 2019-06-27 | 1.6.0 | Cross-Site Scripting via JSONP |