CVE-2026-111753

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.

References

• https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b
• https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e
• https://github.com/angular/angular/issues/71294
• https://github.com/angular/angular/pull/65683
• https://github.com/angular/angular/pull/71295