I'm reading an article that talks about XSS exploitation on AngularJS,

enter image description here

AngularJS will render the template in ng-html, and it bypasses sanitize-html.

My questions,

  1. I'm wondering if other frameworks like Vue.js and React is also vulnerable to this attack?
    • I tried to use {{ }} in React and it's not executed by dangerouslySetInnerHTML method.
    • I tried to use {{ }} in Vue.js and it's not parsed by v-html directive.
  2. Why isn't other frameworks affected in this way?
  • AngularJS is pretty old. "Angular" (2016 and forward) has built-in XSS protections. Having said that ALL frameworks are vulnerable to XSS. Don't rely on a framework to automatically make everything secure from attack, though keeping them up to date helps a bit. (test backend/frontend) Commented Apr 15 at 17:30


You must log in to answer this question.

Browse other questions tagged .