SEC-043
End-of-life AngularJS 1.x in use
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Version numbers in script URLs, file names and library banner comments, against the angularjs entries of the Retire.js vulnerability repository (fetched 2026-10-28). A bundle without a visible version is not judged.
Why it matters
AngularJS receives no security fixes since January 2022 and has several public sandbox-escape and XSS issues.
Recommended fix
Migrate to a supported framework, or use a commercially supported AngularJS fork.
How to verify
Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-043: End-of-life AngularJS 1.x in use
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Plan the migration away from AngularJS 1.x: list the views that depend on it, and propose the smallest path to a supported framework. Until then, make sure no user input is ever compiled as an AngularJS template.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).