CVE-2023-26116

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-1333

Affected software

VendorProductVersions
n/aangular>= 1.2.21, < *
n/aorg.webjars.bower:angular>= 1.2.21, < *
n/aorg.webjars.npm:angular>= 1.2.23, < *
n/aorg.webjars.bowergithub.angular:angular< *

References

Timeline

Published
Mar 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261175.3Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to tCVE-2023-261185.3Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> elementCVE-2023-261199.8Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, whCVE-2023-26124.7Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode lockiCVE-2023-261206.1This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add anCVE-2023-2612110.0All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its pCVE-2023-2612210.0All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived fromCVE-2023-261236.1Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does notCVE-2023-261257.3Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a sCVE-2023-261265.3All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested viCVE-2023-261277.8All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. *CVE-2023-261287.8All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and san