AngularJS: version with known vulnerabilities

best_practices.vulnerable_libraries.angularjs

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, vulnerable libraries

What the rule checks

Scope. Applies to pages on which the library is detected: its window global (with its version field) or, for jQuery, Bootstrap, AngularJS, Lodash and Handlebars, a script URL whose path names the library and a version.

Expectation. Fails for every detected AngularJS (1.x) version: the line is end of life and every release, including the last one 1.8.3, is covered by an advisory. There is no conforming version; the negative is a look-alike: Angular 2+ (@angular/core) is a different framework and not AngularJS. Detected through `angular.version.full` or a script path naming angular.js (not angular/). A page without the library: not applicable. A page that breaks the detection scripts (result missing or malformed) is not run for every library, never clean.

Source. retire.js jsrepository-v4.json (GitHub/NVD advisories), reviewed 2026-10-26; AngularJS end of life (January 2022); CVE-2022-25844 (>= 1.7.0, no fix), CVE-2023-26116..26118 (< 1.8.4, never released)

Detection: analyze_vulnerable_libraries; needs dom.

Failing example

The check reports a violation here. Corpus case vulnerable_libs_dollar_alias. The page may contain further findings for other rules.

vulnerable_libs_dollar_alias.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>jQuery only as $, Bootstrap via attribute</title>
  <script>
    // jQuery.noConflict() hands back `jQuery`; some pages keep only `$`.
    window.$ = { fn: { jquery: "3.4.1" } };
    // AngularJS is end of life: even its last release is flagged.
    window.angular = { version: { full: "1.8.3" } };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>jQuery only as $, Bootstrap via attribute</h1>
    <div data-bs-version="4.0.0"></div>
  </main>
</body>
</html>

Passing example

The check reports nothing here. Corpus case vulnerable_libs_lookalikes. The page may contain further findings for other rules.

vulnerable_libs_lookalikes.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Plugins and namespaces that look like libraries</title>
  <!-- Plugins carry their own version, not the library's. -->
  <script src="/ui/1.12.1/jquery-ui.min.js"></script>
  <script src="/js/jquery.validate-1.19.5.min.js"></script>
  <script src="/js/bootstrap-datepicker-1.9.0.min.js"></script>
  <!-- Angular 2+ is not AngularJS. -->
  <script type="module" src="/npm/@angular/core@17.3.0/fesm2022/core.mjs"></script>
  <script>
    // An application class and namespace that only share a name.
    window.Prototype = class Prototype { constructor() { this.screens = []; } };
    window.MooToolsMigration = { done: true, version: "2.0.0" };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>Plugins and namespaces that look like libraries</h1>

  </main>
</body>
</html>

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.