---
title: AngularJS – Denial of Service attack through DOM clobbering on versions under 1.6.3
description: "Impact Area Security       Severity High       Affected Element **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-007 **(for ServiceNow) **SF-JSL-007 **(for Salesforce) ## Impact An XSS attack via DOM “clobbering” (attempting to insert malicious DOM elements)…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/angularjs-denial-of-service-attack-through-dom-clobbering-on-versions-under-1-6-3/"
updated: "2025-03-21"
category: Rules
---

# AngularJS – Denial of Service attack through DOM clobbering on versions under 1.6.3

Impact Area

Security

 

 

 

           Severity

High

 

 

 

           Affected Element

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-007 **(for ServiceNow)

**SF-JSL-007 **(for Salesforce)

## Impact

An XSS attack via DOM “clobbering” (attempting to insert malicious DOM elements) could result in the browser hanging when $sanitize attempts to traverse the HTML, as the clobbered elements cause $sanitize to go into an infinite loop. While the XSS attack is prevented, the browser will hang, resulting in a Denial of Service situation.

## Remediation

Update AngularJS to the latest version.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)](https://cwe.mitre.org/data/definitions/79.html).