Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-34840: Angular UI Notification Cross-Site Scripting Flaw Affects Popular JavaScript Library

CVE-2023-34840 · published 3 years ago

Summary

The Angular UI Notification library, used by many websites and applications, contains a security flaw that could allow hackers to inject malicious code. This could potentially allow an attacker to steal sensitive information or take control of a user's session. Update to the latest version of the library to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	alexcrack	angular-ui-notification	>= 0.1.0, <= 0.3.6
–	angular-ui-notification_project	angular-ui-notification	<= 0.3.6 `cpe:2.3:a:angular-ui-notification_project:angular-ui-notification::::::::`

Original advisory text

angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.

References

http://alexcrack.com
https://github.com/advisories/GHSA-mrcj-5qxr-vhp2
https://nvd.nist.gov/vuln/detail/CVE-2023-34840 Vendor Advisory
https://github.com/Xh4H/CVE-2023-34840 Product
https://github.com/alexcrack/angular-ui-notification Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34840... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published30 Jun 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-mrcj-5qxr-vhp2 · GHSA

CVE-2023-34840 · NVD

CVE-2023-34840 · MITRE

CVE-2023-34840 · OSV

Track software like this

Free during beta