CVE-2026-111753

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.

• CWE-201
• CWE-359

• https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b
• https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e
• https://github.com/angular/angular/issues/71294
• https://github.com/angular/angular/pull/65683
• https://github.com/angular/angular/pull/71295
• https://github.com/angular/angular/releases/tag/21.0.3
• https://github.com/angular/angular/releases/tag/v20.3.34
• https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111748AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111749AIOHTTP is an asynchronous HTTP client/server framework for …2.3
• CVE-2026-11175Incorrect security UI in Messages in Google Chrome on Androi…8.8
• CVE-2026-111750AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111751Angular is a development platform for building mobile and de…8.2
• CVE-2026-111752Angular is a development platform for building mobile and de…8.2
• CVE-2026-111754Angular is a development platform for building mobile and de…5.1
• CVE-2026-111755follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111756follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
• CVE-2026-111757Hono is a Web application framework that provides support fo…5.3
• CVE-2026-111758markdown-it is a Markdown parser. From versions 14.1.0 to be…7.5
• CVE-2026-111759markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2…7.5