---
title: AngularJS – XSS Vulnerability On Versions Under 1.8.0, Via JQLite DOM Manipulation Functions
description: "**Impact area** Security **Severity** High **Affected element** **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-ANGULARJS-LESSTHAN-V180-JQL (**for ServiceNow) **SF-JSL-ANGULARJS-LESSTHAN-V180-JQL **(for Salesforce) ## Impact XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/angularjs-xss-vulnerability-on-versions-under-1-8-0-via-jqlite-dom-manipulation-functions/"
updated: "2025-03-21"
category: Rules
---

# AngularJS – XSS Vulnerability On Versions Under 1.8.0, Via JQLite DOM Manipulation Functions

**Impact area**

Security

**Severity**

High

**Affected element**

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-ANGULARJS-LESSTHAN-V180-JQL (**for ServiceNow)

**SF-JSL-ANGULARJS-LESSTHAN-V180-JQL **(for Salesforce)

## Impact

XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.

## Remediation

Update AngularJS to the latest version.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').](https://cwe.mitre.org/data/definitions/79.html)