{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0"
                  },
                  {
                    "last_affected": "19.2.25"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "introduced": "20.0.0"
                  },
                  {
                    "fixed": "20.3.34"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "introduced": "21.0.0"
                  },
                  {
                    "fixed": "21.0.3"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "fixed": "20474d3f0fd7c64071add6e84acf720627e5c19b"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "range": [
                  {
                    "fixed": "933ce817d53e25926844fa56af8230816763d08e"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "original_tag": "21.0.3",
                "range": [
                  {
                    "fixed": "c355ffd99e691fffe5a53e5069d8fc4291676869"
                  }
                ],
                "source": "REFERENCES_TAG"
              },
              {
                "original_tag": "v20.3.34",
                "range": [
                  {
                    "fixed": "329172858b99ab3910b15c1e79bd49b0d5094b30"
                  }
                ],
                "source": "REFERENCES_TAG"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6d1753b46b7389c10aa17da2327043fbf5296035"
            },
            {
              "introduced": "40e2b5b4d13792ed7c46a1d22afcf6c12ac9c679"
            },
            {
              "fixed": "329172858b99ab3910b15c1e79bd49b0d5094b30"
            },
            {
              "introduced": "00dcbf2eeb3fd18ed39148e4bc9e49a5b35cae0c"
            },
            {
              "fixed": "c355ffd99e691fffe5a53e5069d8fc4291676869"
            },
            {
              "fixed": "20474d3f0fd7c64071add6e84acf720627e5c19b"
            },
            {
              "fixed": "933ce817d53e25926844fa56af8230816763d08e"
            }
          ],
          "repo": "https://github.com/angular/angular",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-jfgx-762w-99vr"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-201",
      "CWE-359"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111753.json"
  },
  "details": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.",
  "id": "CVE-2026-111753",
  "modified": "2026-11-07T02:30:21.262435861Z",
  "published": "2026-11-05T20:25:07.322Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/21.0.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/v20.3.34"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111753.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111753"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/angular/angular/issues/71294"
    },
    {
      "type": "FIX",
      "url": "https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e"
    },
    {
      "type": "FIX",
      "url": "https://github.com/angular/angular/pull/65683"
    },
    {
      "type": "FIX",
      "url": "https://github.com/angular/angular/pull/71295"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)"
}