[@angular/compiler] Angular vulnerable to XSS in i18n attribute bindings

**[@angular/compiler] Angular vulnerable to XSS in i18n attribute bindings**

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. The following example illustrates the issue: <a href="{{maliciousUrl}}" i18n-href>Click me</a> The following attributes have been confirmed to be vulnerable: action background cite codebase data formaction href itemtype longdesc poster src xlink:href Impact When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables: Session Hijacking: Stealing session cookies and authentication tokens...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.