A flaw in Contextual Escaping logic allows attackers to bypass the regular‑expression checks that protect resource URLs. By crafting specially formatted URLs, an attacker can inject executable JavaScript into the browser context when the URL is interpreted as a script or iframe source. This improper validation is classified as CWE‑791 and results in an XSS vulnerability that can be used to hijack sessions, steal credentials, deface webpages, or execute other malicious actions.

All releases of AngularJS from version 1.2.0‑rc.3 onward are affected. The AngularJS project is end‑of‑life and will not receive any security updates, so the vulnerability remains unpatched in existing installations.

The CVSS score of 7.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can exploit the flaw by delivering a malicious resource URL to any AngularJS‑controlled page that permits untrusted input. The vulnerability is client‑side, which exists on every vulnerable page where user input can influence resource URLs. Consequently, the likelihood of exploitation in susceptible applications is high.