AIKIDO-2026-317476
@angular/ssr is vulnerable to Path Traversal
63
Medium Risk
This Affects:
@angular/ssrTL;DR
CommonEngine in @angular/ssr serves prerendered SSG pages by joining the request pathname onto the configured public directory and checking containment with a startsWith prefix comparison. On Windows a request pathname containing backslash traversal sequences such as ..\ escapes the intended public directory, and the prefix comparison also treats sibling directories whose names share a prefix (for example dist\app-admin when dist\app is the public root) as contained. This lets a request read prerendered index.html files from outside the intended output directory. The fix replaces the prefix check with a path.relative() computation that rejects parent traversal and absolute results.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application serves prerendered pages through CommonEngine on a Windows host.
Background info
@angular/ssr is vulnerable to Path Traversal in versions 17.0.0 - 20.3.35, 21.0.0 - 21.2.22 and 22.0.0 - 22.1.6.
How to fix this
Upgrade the @angular/ssr library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.