Angular vulnerabilities

1. What are the vulnerability issues in Angular?
2. Is Angular vulnerable to XSS?
3. Why Angular is not secure?
4. What are the vulnerabilities of Angular 1.4 1?

What are the vulnerability issues in Angular?

There are two HTTP vulnerabilities that affect any Angular application: cross-site request forgery (CSRF or XSRF) and cross-site script inclusion (XSSI). But Angular has built-in helpers to prevent them at client-side itself.

Is Angular vulnerable to XSS?

In the case your Trusted-Types-enabled application runs in a browser that doesn't support Trusted Types, the features of the application are preserved. Your application is guarded against XSS by way of Angular's DomSanitizer. See caniuse.com/trusted-types for the current browser support.

Why Angular is not secure?

Angular does not have control over these DOM APIs, so it does not provide protection against security vulnerabilities and attackers can inject malicious code into the DOM tree.

What are the vulnerabilities of Angular 1.4 1?

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code.