What is CVE-2020-7676?

CVE-2020-7676 is a medium-severity vulnerability in Angularjs, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2020-06-08.

How severe is CVE-2020-7676?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2020-7676 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Angularjs

CVE-2020-7676

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2020-06-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.019 (79.2th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 79.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.021 · newest: 0.019 · change: -0.002

Affected products

Angularjs
Angular.js — versions All versions prior to 1.8.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

github.com/angular/angular.js/pull/17028,
snyk.io/vuln/SNYK-JS-ANGULAR-570058 (Third Party Advisory)
lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75… (mailing-list)
lists.apache.org/thread.html/r3f05cfd587c774ea83c18e59eda9fa37fa9bbf3421484d4ee… (mailing-list)
lists.apache.org/thread.html/r57383582dcad2305430321589dfaca6793f5174c55da6ce8d… (mailing-list)
lists.apache.org/thread.html/r198985c02829ba8285ed4f9b1de54a33b5f31b08bb38ac51f… (mailing-list)
lists.apache.org/thread.html/r79e3feaaf87b81e80da0e17a579015f6dcb94c95551ced398… (mailing-list)
lists.apache.org/thread.html/r455ebd83a1c69ae8fd897560534a079c70a483dbe1e75504f… (mailing-list)
lists.apache.org/thread.html/rb6423268b25db0f800359986867648e11dbd38e133b9383e8… (mailing-list)
lists.apache.org/thread.html/r80f210a5f4833d59c5d3de17dd7312f9daba0765ec7d40524… (mailing-list)

Frequently asked questions

What is CVE-2020-7676?: CVE-2020-7676 is a medium-severity vulnerability in Angularjs, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2020-06-08.
How severe is CVE-2020-7676?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2020-7676 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.