{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.8.3"}],"component":"angular","cve_ids":["CVE-2023-26118"],"ecosystem":"npm","epss":0.01695,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qwqh-hm9m-p5hr","id":"tcs_01M5KG7D657DAE5AMSH8YYSBJG","modified_at":"2026-09-10T03:49:52.909648280Z","published_at":"2023-03-30T06:30:25Z","references":["https://osv.dev/vulnerability/GHSA-qwqh-hm9m-p5hr","https://nvd.nist.gov/vuln/detail/CVE-2023-26118","https://github.com/angular/angular.js","https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406326","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406328","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406327","https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373046","https://stackblitz.com/edit/angularjs-vulnerability-inpur-url-validation-redos"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-qwqh-hm9m-p5hr","url":"https://osv.dev/vulnerability/GHSA-qwqh-hm9m-p5hr"}],"summary":"angular vulnerable to regular expression denial of service via the <input type=\"url\"> element"}