Skip to content
XSS without HTML: Client-Side Template Injection with AngularJS
portswigger.net | research | #appsec | #web-security | #xss | #sandbox-escape | #template-injection | #client-side | #angularjs
Summary
Gareth Heyes explains client-side template injection in AngularJS and presents a fresh sandbox escape affecting Angular 1.3.1+ and 1.4.0+, enabling XSS even when user input is HTML-encoded.
- Published
- Collected