GHSA-r3hf-q8q7-fv2p: 
JavaScript vulnerability analysis and mitigation

A high-severity Cross-site Scripting (XSS) vulnerability was discovered in Angular Universal applications using critical CSS inlining, affecting versions 16.1.0 and 16.1.1 of @nguniversal/common npm package. The vulnerability was disclosed on August 8, 2023, and was assigned the identifier GHSA-r3hf-q8q7-fv2p. This security issue allows attackers to execute malicious JavaScript by tricking users into visiting specially crafted pages (GitHub Advisory).

The vulnerability specifically affects the critical CSS inlining functionality in Angular Universal applications. While Angular CLI applications without Universal also perform critical CSS inlining, exploitation in those cases would require direct access to modify source code. The vulnerability is classified with CWE-79 (Cross-site Scripting) and has been assigned a high severity rating (Angular Universal Advisory).

When exploited, this vulnerability allows attackers to perform cross-site scripting attacks by injecting malicious JavaScript code. The attack vector involves tricking users into visiting compromised pages, potentially leading to unauthorized code execution in the context of the victim's browser (GitHub Advisory).

Users are advised to upgrade @nguniversal/common to version 16.1.2 or higher, as this version contains the security fix. Alternatively, users can either downgrade to version 16.0.x or lower, or override the critters dependency with version 0.0.20 in their package.json using the following configuration: { "overrides": { "critters": "0.0.20" } } (GitHub Advisory).