---
id: 5543
title: "XSS without HTML: Client-Side Template Injection with AngularJS"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/xss-without-html-client-side-template-injection-with-angularjs"
published_at: "2025-12-17T15:21:00Z"
tags: ["appsec", "web-security", "xss", "sandbox-escape", "template-injection", "client-side", "angularjs"]
phying_url: "https://phying.com/item/5543"
lang: en
---

# XSS without HTML: Client-Side Template Injection with AngularJS

## Summary

Gareth Heyes explains client-side template injection in AngularJS and presents a fresh sandbox escape affecting Angular 1.3.1+ and 1.4.0+, enabling XSS even when user input is HTML-encoded.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-12-17T15:21:00Z
- **Original:** https://portswigger.net/research/xss-without-html-client-side-template-injection-with-angularjs
- **Phying News:** https://phying.com/item/5543