Prototype pollution in AngularJS
Priority LOW 37CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 5 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-915.
Summary
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
Why it matters now
EPSS 0.01982 80th percentileScored 2026-11-07
Fix Partial angular (npm): 1.7.9Red Hat: 5 advisoriesRed Hat: 5 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | AngularJS | All versions prior to version 1.7.9 | — | No fix listed | CNA |
| — | angular (npm) | before 1.7.9 | 1.7.9 | Patch available | GHSA-89mq-4x47-5v83 |
- AngularJS Vendor— Affected All versions prior to version 1.7.9 Fixed in — No fix listed CNA
- angular (npm) Vendor— Affected before 1.7.9 Fixed in 1.7.9 Patch available GHSA-89mq-4x47-5v83
Remediation
- Fix · GHSA-89mq-4x47-5v83 angular (npm) Fixed in 1.7.9 Advisory →
Red Hat 5 advisories
- RHSA-2023:0274 Released 2023-01-25 · Red Hat rating ModerateRed Hat OpenStack Platform 17.0 (python-XStatic-Angular) security update
- Red Hat OpenStack Platform 17.0 XStatic-Angular-common-1:1.5.8.0-15.el9ost, python-XStatic-Angular-1:1.5.8.0-15.el9ost, python3-XStatic-Angular-1:1.5.8.0-15.el9ost
- RHSA-2022:8866 Released 2022-12-07 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update
- Red Hat OpenStack Platform 16.1 XStatic-Angular-common-1:1.5.8.0-13.el8ost, python-XStatic-Angular-1:1.5.8.0-13.el8ost, python3-XStatic-Angular-1:1.5.8.0-13.el8ost
- RHSA-2022:8849 Released 2022-12-07 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) security update
- Red Hat OpenStack Platform 16.2 XStatic-Angular-common-1:1.5.8.0-13.el8ost, python-XStatic-Angular-1:1.5.8.0-13.el8ost, python3-XStatic-Angular-1:1.5.8.0-13.el8ost
Show 2 more Red Hat advisories
- RHSA-2021:0417 Released 2021-02-04 · Red Hat rating ModerateRed Hat AMQ Broker 7.8.1 release and security update
- Red Hat AMQ 7.8.1
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat AMQ 7.8.1 | Fixed | RHSA-2021:0417 |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2022:8866 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2022:8849 |
| Red Hat OpenStack Platform 17.0 | Fixed | RHSA-2023:0274 |
Not affected: 2 products
- OpenShift Service Mesh 1
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10768
- 2026-10-03 Alias added: GHSA-89mq-4x47-5v83
References
Other 5
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- https://github.com/angular/angular.js/pull/16913
- https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3
- https://github.com/angular/angular.js
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
More Angularjs vulnerabilities
- TI-2023-11343 Regular expression denial of service in angular CVSS 3.1MEDIUM 5.3
- TI-2023-11342 Regular expression denial of service in angular CVSS 3.1MEDIUM 5.3
- TI-2023-11341 Regular expression denial of service in angular CVSS 3.1MEDIUM 5.3
- TI-2024-07764 AngularJS improper sanitization in '<source>' element CVSS 3.1MEDIUM 4.8
- TI-2024-07763 AngularJS improper sanitization in 'srcset' attribute CVSS 3.1MEDIUM 4.8
- TI-2022-09411 Regular expression denial of service (ReDoS) in angular CVSS 3.1HIGH 7.5
Sources
- CVE-2019-10768 · CVE Program
- CVE-2019-10768 · NVD
- FIRST EPSS
- GHSA-89mq-4x47-5v83 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10768 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences