{"action":"Upgrade angular to 1.5.0-beta.1 or later.","affected":[{"fixed":"1.5.0-beta.1","introduced":"0"}],"component":"angular","cve_ids":["CVE-2019-14863"],"ecosystem":"npm","epss":0.01198,"exploited":false,"fixed_versions":["1.5.0-beta.1"],"ghsa_id":"GHSA-r5fx-8r73-v86c","id":"tcs_01M5KG81F94X9VPK2J4D49VVFP","modified_at":"2025-11-20T19:30:06Z","published_at":"2020-02-14T23:08:49Z","references":["https://osv.dev/vulnerability/GHSA-r5fx-8r73-v86c","https://nvd.nist.gov/vuln/detail/CVE-2019-14863","https://github.com/angular/angular.js/pull/12524","https://github.com/angular/angular.js/commit/35a21532b73d5bd84b4325211c563e6a3e2dde82","https://github.com/angular/angular.js/commit/f33ce173c90736e349cf594df717ae3ee41e0f7a","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863","https://github.com/angular/angular.js","https://snyk.io/vuln/npm:angular:20150807","https://www.npmjs.com/advisories/1453"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-r5fx-8r73-v86c","url":"https://osv.dev/vulnerability/GHSA-r5fx-8r73-v86c"}],"summary":"AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes"}