AIKIDO-2026-10985
@angular/build is vulnerable to Path Traversal
42
Medium Risk
This Affects:
@angular/buildTL;DR
The Angular application builder resolves asset patterns from angular.json without ensuring object-form input paths stay inside the workspace root. A project configuration that points input outside the workspace can cause the build or dev-server asset pipeline to read or publish files beyond the intended project boundary. Before the fix, relative and absolute paths outside the workspace were accepted during asset normalization and resolution. The patch adds isSubDirectory checks that reject out-of-root input values during build and asset resolution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@angular/build is vulnerable to Path Traversal in versions 18.0.0 - 21.2.12.
How to fix this
Upgrade the @angular/build library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant