https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 08:19:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-111754 <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router&#39;s final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router&#39;s final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-111754 https://db.gcve.eu/vuln/ghsa-w739-gvwx-grc3 <p><strong>Affected:</strong> npm: @angular/platform-server</p> <p>An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.</p> <p>When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.</p> <p>When a request URL includes a popping dot-segment followed by multiple slashes (such as `/.//evil.test` or serialized from router route shapes like `/.;/(//evil.test)`), the input bypassed the initial `urlStr.startsWith(&#39;//&#39;)` check. Subsequent WHATWG URL parsing resolved the dot-segments and resulted in a `pathname` starting with `//` (`//evil.test`).</p> <p>Consequently, `ServerPlatformLocation` stored `pathname = &#39;//evil.test&#39;`. When `@angular/ssr` detected a mismatch between the rendered URL and the router&#39;s final location state, it emitted the unnormalized pathname into the HTTP `Location` response header, producing an HTTP 302 redirect with `Location: //evil.test`, which browsers resolve as a protocol-relative navigation off-origin.</p> <p>### Impact</p> <p>Successful exploitation allows an unauthenticated remote attacker to craft URLs that trick Angular SSR into redirecting users to an arbitrary external domain.</p> <p>* **Bypasses Application-Level Guards:** Common application-level validation routines (such as checking `!returnUrl.startsWith(&#39;//&#39;)` before inv…</p> <p><strong>Affected:</strong> npm: @angular/platform-server</p> <p>An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.</p> <p>When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.</p> <p>When a request URL includes a popping dot-segment followed by multiple slashes (such as `/.//evil.test` or serialized from router route shapes like `/.;/(//evil.test)`), the input bypassed the initial `urlStr.startsWith(&#39;//&#39;)` check. Subsequent WHATWG URL parsing resolved the dot-segments and resulted in a `pathname` starting with `//` (`//evil.test`).</p> <p>Consequently, `ServerPlatformLocation` stored `pathname = &#39;//evil.test&#39;`. When `@angular/ssr` detected a mismatch between the rendered URL and the router&#39;s final location state, it emitted the unnormalized pathname into the HTTP `Location` response header, producing an HTTP 302 redirect with `Location: //evil.test`, which browsers resolve as a protocol-relative navigation off-origin.</p> <p>### Impact</p> <p>Successful exploitation allows an unauthenticated remote attacker to craft URLs that trick Angular SSR into redirecting users to an arbitrary external domain.</p> <p>* **Bypasses Application-Level Guards:** Common application-level validation routines (such as checking `!returnUrl.startsWith(&#39;//&#39;)` before inv…</p> https://db.gcve.eu/vuln/ghsa-w739-gvwx-grc3