Search
Find a vulnerability
Search criteria
86 vulnerabilities by angular
CVE-2026-101897 (GCVE-0-2026-101897)
Vulnerability from nvd – Published: 2026-10-14 15:03 – Updated: 2026-10-14 15:03
VLAI
EPSS
VEX
Title
Angular DevTools (Local DoS)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.
Severity
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/70623 | x_refsource_MISC |
| https://github.com/angular/angular/commit/7c05359… | x_refsource_MISC |
| https://github.com/angular/angular/commit/cf492e8… | x_refsource_MISC |
| https://github.com/angular/angular/commit/e02c4d8… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 22.2.0-rc.0"
}
]
},
{
"product": "DevTools",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.20.0, \u003c 1.21.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-940",
"description": "CWE-940: Improper Verification of Source of a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:03:36.405Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c"
},
{
"name": "https://github.com/angular/angular/pull/70623",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/70623"
},
{
"name": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d"
},
{
"name": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f"
},
{
"name": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3"
}
],
"source": {
"advisory": "GHSA-r653-wxfp-pp9c",
"discovery": "UNKNOWN"
},
"title": "Angular DevTools (Local DoS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101897",
"datePublished": "2026-10-14T15:03:36.405Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-10-14T15:03:36.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101896 (GCVE-0-2026-101896)
Vulnerability from nvd – Published: 2026-10-14 15:05 – Updated: 2026-10-14 15:05
VLAI
EPSS
VEX
Title
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.
Severity
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/70716 | x_refsource_MISC |
| https://github.com/angular/angular/pull/70717 | x_refsource_MISC |
| https://github.com/angular/angular/commit/03872a8… | x_refsource_MISC |
| https://github.com/angular/angular/commit/5af6121… | x_refsource_MISC |
| https://github.com/angular/angular/commit/ddfe210… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.2.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.32"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.24"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.2.0"
}
]
},
{
"product": "router",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.32"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.24"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:05:42.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3"
},
{
"name": "https://github.com/angular/angular/issues/70716",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/70716"
},
{
"name": "https://github.com/angular/angular/pull/70717",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/70717"
},
{
"name": "https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583"
},
{
"name": "https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d"
},
{
"name": "https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.32"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.24"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.2.0"
}
],
"source": {
"advisory": "GHSA-ff3f-86qr-9cv3",
"discovery": "UNKNOWN"
},
"title": "Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101896",
"datePublished": "2026-10-14T15:05:42.934Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-10-14T15:05:42.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101895 (GCVE-0-2026-101895)
Vulnerability from nvd – Published: 2026-10-14 15:00 – Updated: 2026-10-14 15:00
VLAI
EPSS
VEX
Title
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
Severity
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/commit/3db26e2… | x_refsource_MISC |
| https://github.com/angular/angular/commit/fc2e8fb… | x_refsource_MISC |
| https://github.com/angular/domino/commit/4d974731… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.6 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
<= 19.2.25
Affected: >= 20.0.0, < 20.3.31 Affected: >= 21.0.0, < 21.2.23 Affected: >= 22.0.0, < 22.1.6 |
|
| @angular/ | platform-server |
Affected:
<= 19.2.25
Affected: >= 20.0.0, < 20.3.31 Affected: >= 21.0.0, < 21.2.23 Affected: >= 22.0.0, < 22.1.6 |
{
"containers": {
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.31"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.23"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.6"
}
]
},
{
"product": "platform-server",
"vendor": "@angular/",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.31"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.23"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:00:14.385Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7"
},
{
"name": "https://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25"
},
{
"name": "https://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567"
},
{
"name": "https://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6f"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.31"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.23"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.6"
}
],
"source": {
"advisory": "GHSA-f67j-2jqw-jpq7",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101895",
"datePublished": "2026-10-14T15:00:14.385Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-10-14T15:00:14.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104871 (GCVE-0-2026-104871)
Vulnerability from nvd – Published: 2026-10-02 19:43 – Updated: 2026-10-02 20:12
VLAI
EPSS
VEX
Title
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Summary
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 20:12 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular-cli/security/a… | x_refsource_CONFIRM |
| https://github.com/angular/angular-cli/commit/645… | x_refsource_MISC |
| https://github.com/angular/angular-cli/commit/707… | x_refsource_MISC |
| https://github.com/angular/angular-cli/commit/bb7… | x_refsource_MISC |
| https://github.com/angular/angular-cli/commit/c3e… | x_refsource_MISC |
| https://github.com/angular/angular-cli/releases/t… | x_refsource_MISC |
| https://github.com/angular/angular-cli/releases/t… | x_refsource_MISC |
| https://github.com/angular/angular-cli/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular-cli |
Affected:
< 20.3.36
Affected: >= 21.0.0, < 21.2.23 Affected: >= 22.0.0, < 22.1.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104871",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T20:12:27.563771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T20:12:49.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular-cli",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.36"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.23"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T19:43:50.475Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q"
},
{
"name": "https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2"
},
{
"name": "https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755"
},
{
"name": "https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841"
},
{
"name": "https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914"
},
{
"name": "https://github.com/angular/angular-cli/releases/tag/v20.3.36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/releases/tag/v20.3.36"
},
{
"name": "https://github.com/angular/angular-cli/releases/tag/v21.2.23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/releases/tag/v21.2.23"
},
{
"name": "https://github.com/angular/angular-cli/releases/tag/v22.1.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/releases/tag/v22.1.7"
}
],
"source": {
"advisory": "GHSA-7g7c-h8rr-7p6q",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104871",
"datePublished": "2026-10-02T19:43:50.475Z",
"dateReserved": "2026-10-02T14:59:11.775Z",
"dateUpdated": "2026-10-02T20:12:49.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88060 (GCVE-0-2026-88060)
Vulnerability from nvd – Published: 2026-09-10 19:04 – Updated: 2026-09-10 19:20
VLAI
EPSS
VEX
Title
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 19:19 UTC
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/commit/73d8bbd… | x_refsource_MISC |
| https://github.com/angular/angular/commit/89b2056… | x_refsource_MISC |
| https://github.com/angular/angular/commit/ba3bc47… | x_refsource_MISC |
| https://github.com/angular/domino/commit/04f987dc… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88060",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T19:19:47.937061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T19:20:56.297Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.30"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.22"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer\u0027s fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T19:04:17.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
},
{
"name": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915"
},
{
"name": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
},
{
"name": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
},
{
"name": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.30"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.22"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.4"
}
],
"source": {
"advisory": "GHSA-v3p8-whq6-r5jg",
"discovery": "UNKNOWN"
},
"title": "Angular: SSR XSS via Unescaped \u003ctemplate\u003e Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88060",
"datePublished": "2026-09-10T19:04:17.420Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-10T19:20:56.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88059 (GCVE-0-2026-88059)
Vulnerability from nvd – Published: 2026-09-10 19:00 – Updated: 2026-09-11 17:50
VLAI
EPSS
VEX
Title
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 17:49 UTC
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/69777 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69778 | x_refsource_MISC |
| https://github.com/angular/angular/commit/c45028e… | x_refsource_MISC |
| https://github.com/angular/angular/commit/caf6166… | x_refsource_MISC |
| https://github.com/angular/angular/commit/e4c416c… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T17:49:17.182667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T17:50:22.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.28"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.20"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular\u0027s @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user\u0027s sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T19:00:12.376Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c"
},
{
"name": "https://github.com/angular/angular/issues/69777",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/69777"
},
{
"name": "https://github.com/angular/angular/pull/69778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69778"
},
{
"name": "https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af"
},
{
"name": "https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d"
},
{
"name": "https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.28"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.20",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.20"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.1"
}
],
"source": {
"advisory": "GHSA-p297-fm68-3q8c",
"discovery": "UNKNOWN"
},
"title": "Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88059",
"datePublished": "2026-09-10T19:00:12.376Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-11T17:50:22.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88058 (GCVE-0-2026-88058)
Vulnerability from nvd – Published: 2026-09-10 18:56 – Updated: 2026-09-11 15:14
VLAI
EPSS
VEX
Title
Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 15:14 UTC
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/70146 | x_refsource_MISC |
| https://github.com/angular/angular/commit/73d8bbd… | x_refsource_MISC |
| https://github.com/angular/angular/commit/89b2056… | x_refsource_MISC |
| https://github.com/angular/angular/commit/ba3bc47… | x_refsource_MISC |
| https://github.com/angular/domino/commit/04f987dc… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88058",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T15:14:28.505071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T15:14:37.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/issues/70146"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.30"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.22"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim\u0027s browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:56:03.369Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4"
},
{
"name": "https://github.com/angular/angular/issues/70146",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/70146"
},
{
"name": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915"
},
{
"name": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
},
{
"name": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
},
{
"name": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.30"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.22"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.4"
}
],
"source": {
"advisory": "GHSA-j3r3-mxqp-r2p4",
"discovery": "UNKNOWN"
},
"title": "Angular: SSR XSS via Unescaped Processing Instruction (\u003c?...?\u003e) Nodes in Fallback Raw-Content Elements"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88058",
"datePublished": "2026-09-10T18:56:03.369Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-11T15:14:37.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88057 (GCVE-0-2026-88057)
Vulnerability from nvd – Published: 2026-09-10 18:46 – Updated: 2026-09-11 20:32
VLAI
EPSS
VEX
Title
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 16:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/69550 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69558 | x_refsource_MISC |
| https://github.com/angular/angular/commit/2f96c80… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6afe6fa… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6caa298… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T16:34:33.902581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:32:49.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.28"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.20"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular\u0027s compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular\u0027s built-in sanitizer and execute arbitrary JavaScript in the user\u0027s browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:46:51.847Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg"
},
{
"name": "https://github.com/angular/angular/issues/69550",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/69550"
},
{
"name": "https://github.com/angular/angular/pull/69558",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69558"
},
{
"name": "https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264"
},
{
"name": "https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee"
},
{
"name": "https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.28"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.20",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.20"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.0"
}
],
"source": {
"advisory": "GHSA-hh8m-fm6v-7cvg",
"discovery": "UNKNOWN"
},
"title": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88057",
"datePublished": "2026-09-10T18:46:51.847Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-11T20:32:49.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88056 (GCVE-0-2026-88056)
Vulnerability from nvd – Published: 2026-09-10 18:42 – Updated: 2026-09-15 14:56
VLAI
EPSS
VEX
Title
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:56 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/commit/3e924cc… | x_refsource_MISC |
| https://github.com/angular/angular/commit/5aa6d97… | x_refsource_MISC |
| https://github.com/angular/angular/commit/71e52d1… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88056",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:56:19.499267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:56:52.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.30"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.22"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:42:34.054Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
},
{
"name": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c"
},
{
"name": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132"
},
{
"name": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.30"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.22"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.4"
}
],
"source": {
"advisory": "GHSA-f6mr-pjwc-34m4",
"discovery": "UNKNOWN"
},
"title": "Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88056",
"datePublished": "2026-09-10T18:42:34.054Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-15T14:56:52.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69151 (GCVE-0-2026-69151)
Vulnerability from nvd – Published: 2026-08-03 16:23 – Updated: 2026-08-03 21:19
VLAI
EPSS
VEX
Title
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 21:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68821 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69306 | x_refsource_MISC |
| https://github.com/angular/angular/commit/417a407… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6c41f5c… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | compiler |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | core |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T21:17:58.775539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T21:19:24.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "compiler",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "core",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:23:34.121Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99"
},
{
"name": "https://github.com/angular/angular/pull/68821",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68821"
},
{
"name": "https://github.com/angular/angular/pull/69306",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69306"
},
{
"name": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e"
},
{
"name": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865"
}
],
"source": {
"advisory": "GHSA-jj27-h5hq-8x99",
"discovery": "UNKNOWN"
},
"title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69151",
"datePublished": "2026-08-03T16:23:34.121Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T21:19:24.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69149 (GCVE-0-2026-69149)
Vulnerability from nvd – Published: 2026-08-03 16:14 – Updated: 2026-08-03 20:33
VLAI
EPSS
VEX
Title
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/69675 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69714 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69929 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69930 | x_refsource_MISC |
| https://github.com/angular/domino/pull/32 | x_refsource_MISC |
| https://github.com/angular/domino/commit/f88e5aa4… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
|
| @angular | platform-server |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:33:37.200757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:33:46.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
},
{
"product": "platform-server",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (\u003ciframe\u003e, \u003cnoembed\u003e, \u003cnoframes\u003e, and \u003cnoscript\u003e). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:14:39.636Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
},
{
"name": "https://github.com/angular/angular/pull/69675",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69675"
},
{
"name": "https://github.com/angular/angular/pull/69714",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69714"
},
{
"name": "https://github.com/angular/angular/pull/69929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69929"
},
{
"name": "https://github.com/angular/angular/pull/69930",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69930"
},
{
"name": "https://github.com/angular/domino/pull/32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/pull/32"
},
{
"name": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
}
],
"source": {
"advisory": "GHSA-vpx6-8pjr-4g3v",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69149",
"datePublished": "2026-08-03T16:14:39.636Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T20:33:46.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68945 (GCVE-0-2026-68945)
Vulnerability from nvd – Published: 2026-08-03 15:58 – Updated: 2026-08-03 16:58
VLAI
EPSS
VEX
Title
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 16:58 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68571 | x_refsource_MISC |
| https://github.com/angular/angular/commit/6867f77… | x_refsource_MISC |
| https://github.com/angular/angular/commit/948a8d6… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a64e288… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a6c7fc5… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T16:58:17.198889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:58:26.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
},
{
"product": "common",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:58:02.299Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
},
{
"name": "https://github.com/angular/angular/pull/68571",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68571"
},
{
"name": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
},
{
"name": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
},
{
"name": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
},
{
"name": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
}
],
"source": {
"advisory": "GHSA-jhpw-976m-542j",
"discovery": "UNKNOWN"
},
"title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68945",
"datePublished": "2026-08-03T15:58:02.299Z",
"dateReserved": "2026-07-31T21:49:24.928Z",
"dateUpdated": "2026-08-03T16:58:26.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50556 (GCVE-0-2026-50556)
Vulnerability from nvd – Published: 2026-06-22 15:38 – Updated: 2026-07-15 00:46
VLAI
EPSS
VEX
Title
Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements. When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is treated as a raw-text element. However, domino's serializer completely omitted <noscript> from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of </noscript> in the bound dynamic text was never escaped under any circumstances. The unescaped closing tag was serialized directly into the output HTML (e.g. <noscript></noscript><script>alert(1)</script></noscript>). When parsed by a browser, it closes the <noscript> block early, allowing the injected <script> block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-22 21:14 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/68903 | x_refsource_MISC |
| https://github.com/angular/domino/pull/29 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-50556 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2491459 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
>= 22.0.0-next.0, < 22.0.0-rc.2
Affected: >= 21.0.0-next.0, < 21.2.16 Affected: >= 20.0.0-next.0, < 20.3.24 Affected: >= 19.0.0-next.0, < 19.2.25 Affected: <= 18.2.14 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T21:14:35.418340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T21:17:45.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "dotnet5.0-build-reference-packages",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "unaffected",
"packageName": "platform-server",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-22T15:38:28.166Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in @angular/platform-server. This Cross-Site Scripting (XSS) vulnerability exists in its DOM emulation dependency, domino, when handling the content of `\u003cnoscript\u003e` elements during server-side rendering. A remote attacker could exploit this by injecting unescaped closing `\u003c/noscript\u003e` tags within dynamic text content. This allows for the execution of arbitrary code in the user\u0027s browser context, potentially leading to information disclosure or other malicious activities."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:46:49.620Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-50556"
},
{
"name": "RHBZ#2491459",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491459"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50556.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T18:02:18.131Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-22T15:38:28.166Z",
"value": "Made public."
}
],
"title": "@angular/platform-server: domino: Angular Platform Server: Cross-Site Scripting via unescaped `\u003c/noscript\u003e` tags in dynamic content",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.16"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.24"
},
{
"status": "affected",
"version": "\u003e= 19.0.0-next.0, \u003c 19.2.25"
},
{
"status": "affected",
"version": "\u003c= 18.2.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of \u003cnoscript\u003e elements. When rendering dynamic text content inside a \u003cnoscript\u003e element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning \u003cnoscript\u003e is treated as a raw-text element. However, domino\u0027s serializer completely omitted \u003cnoscript\u003e from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of \u003c/noscript\u003e in the bound dynamic text was never escaped under any circumstances. The unescaped closing tag was serialized directly into the output HTML (e.g. \u003cnoscript\u003e\u003c/noscript\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003c/noscript\u003e). When parsed by a browser, it closes the \u003cnoscript\u003e block early, allowing the injected \u003cscript\u003e block to execute in the user\u0027s browser context, causing same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T15:38:28.166Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-gxx4-3xcv-f8qx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-gxx4-3xcv-f8qx"
},
{
"name": "https://github.com/angular/angular/issues/68903",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/68903"
},
{
"name": "https://github.com/angular/domino/pull/29",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/pull/29"
}
],
"source": {
"advisory": "GHSA-gxx4-3xcv-f8qx",
"discovery": "UNKNOWN"
},
"title": "Angular: Missing `\u003cnoscript\u003e` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50556",
"datePublished": "2026-06-22T15:38:28.166Z",
"dateReserved": "2026-06-04T21:34:34.426Z",
"dateUpdated": "2026-07-15T00:46:49.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50555 (GCVE-0-2026-50555)
Vulnerability from nvd – Published: 2026-06-22 15:37 – Updated: 2026-06-22 17:58
VLAI
EPSS
VEX
Title
Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing both an astral Unicode character and a closing tag (e.g., 😀</iframe><script>alert(1)</script>). When serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-22 17:56 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/domino/pull/29 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50555",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T17:56:51.469447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T17:58:33.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.16"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.24"
},
{
"status": "affected",
"version": "\u003e= 19.0.0-next.0, \u003c 19.2.25"
},
{
"status": "affected",
"version": "\u003c= 18.2.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of raw-text elements (such as \u003cscript\u003e, \u003cstyle\u003e, and \u003ciframe\u003e). domino supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character indices are calculated based on UTF-16 code units (where astral characters\u2014such as emojis\u2014occupy 2 code units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag (e.g. \u003c/script\u003e, \u003c/style\u003e, or \u003c/iframe\u003e), the index offset calculation in domino\u0027s replacement logic shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing both an astral Unicode character and a closing tag (e.g., \ud83d\ude00\u003c/iframe\u003e\u003cscript\u003ealert(1)\u003c/script\u003e). When serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent \u003cscript\u003e block, leading to same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T15:37:29.943Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-hqr9-c56f-3x7f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-hqr9-c56f-3x7f"
},
{
"name": "https://github.com/angular/domino/pull/29",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/pull/29"
}
],
"source": {
"advisory": "GHSA-hqr9-c56f-3x7f",
"discovery": "UNKNOWN"
},
"title": "Angular: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) in @angular/platform-server"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50555",
"datePublished": "2026-06-22T15:37:29.943Z",
"dateReserved": "2026-06-04T21:34:34.425Z",
"dateUpdated": "2026-06-22T17:58:33.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50184 (GCVE-0-2026-50184)
Vulnerability from nvd – Published: 2026-06-22 15:42 – Updated: 2026-06-23 13:48
VLAI
EPSS
VEX
Title
Angular: Request Credential & Cache Policy Stripping in Angular Service Worker
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-23 13:48 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68904 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50184",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T13:48:06.163682Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T13:48:24.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
},
{
"status": "affected",
"version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
},
{
"status": "affected",
"version": "\u003c= 18.2.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: \u0027omit\u0027) and the HTTP cache mode configuration (such as cache: \u0027no-store\u0027). These are reverted back to standard browser-default parameters (credentials: \u0027same-origin\u0027 and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker\u0027s engine, making private page states accessible or persistent inside the client\u0027s local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T15:50:48.049Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-95qp-cmmw-mgqv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-95qp-cmmw-mgqv"
},
{
"name": "https://github.com/angular/angular/pull/68904",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68904"
}
],
"source": {
"advisory": "GHSA-95qp-cmmw-mgqv",
"discovery": "UNKNOWN"
},
"title": "Angular: Request Credential \u0026 Cache Policy Stripping in Angular Service Worker"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50184",
"datePublished": "2026-06-22T15:42:05.167Z",
"dateReserved": "2026-06-03T22:05:13.644Z",
"dateUpdated": "2026-06-23T13:48:24.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50171 (GCVE-0-2026-50171)
Vulnerability from nvd – Published: 2026-06-22 15:49 – Updated: 2026-06-23 16:02
VLAI
EPSS
VEX
Title
Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits. When parsing a maliciously crafted digitsInfo string with excessively large fraction digit values (e.g., 1.200000000-200000000), the internal roundNumber function attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-23 14:16 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T14:16:53.849153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T16:02:07.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
},
{
"status": "affected",
"version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
},
{
"status": "affected",
"version": "\u003c= 18.2.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits. When parsing a maliciously crafted digitsInfo string with excessively large fraction digit values (e.g., 1.200000000-200000000), the internal roundNumber function attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-834",
"description": "CWE-834: Excessive Iteration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T15:49:51.774Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-p3vc-36g9-x9gr"
}
],
"source": {
"advisory": "GHSA-p3vc-36g9-x9gr",
"discovery": "UNKNOWN"
},
"title": "Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50171",
"datePublished": "2026-06-22T15:49:51.774Z",
"dateReserved": "2026-06-03T20:54:20.433Z",
"dateUpdated": "2026-06-23T16:02:07.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50170 (GCVE-0-2026-50170)
Vulnerability from nvd – Published: 2026-06-22 15:39 – Updated: 2026-06-23 16:00
VLAI
EPSS
VEX
Title
Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the shared TransferState payload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user's private data to other users, leading to a high-severity information disclosure vulnerability. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-23 16:00 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/67964 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T16:00:13.983210Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T16:00:21.739Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
},
{
"status": "affected",
"version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
},
{
"status": "affected",
"version": "\u003c= 18.2.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState. However, the caching mechanism fails to inspect the withCredentials flag or the Cookie header of outgoing requests. As a result, credentialed, user-specific responses may be cached by default in the shared TransferState payload. When these responses are serialized into the HTML, any caching layer (such as a CDN, reverse proxy, or shared server cache) that caches the SSR-rendered HTML page could inadvertently cache and leak one user\u0027s private data to other users, leading to a high-severity information disclosure vulnerability. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T16:01:17.572Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x"
},
{
"name": "https://github.com/angular/angular/pull/67964",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/67964"
}
],
"source": {
"advisory": "GHSA-q6f4-qqrg-jv6x",
"discovery": "UNKNOWN"
},
"title": "Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50170",
"datePublished": "2026-06-22T15:39:08.877Z",
"dateReserved": "2026-06-03T20:54:20.433Z",
"dateUpdated": "2026-06-23T16:00:21.739Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50169 (GCVE-0-2026-50169)
Vulnerability from nvd – Published: 2026-06-22 15:41 – Updated: 2026-06-22 17:32
VLAI
EPSS
VEX
Title
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: 'error'), falling back to the browser's default 'follow' strategy. If the target web application makes client-side requests with a strict policy (e.g., expecting a network error instead of automatically following redirects), the service worker will bypass this instruction and automatically follow HTTP 3xx redirects to other destinations. This acts as an unintended proxy/intermediary ("Confused Deputy") and can result in cookie/credential exposure or same-origin session-restricted data leakage if public dynamic routes redirect to sensitive routes. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-22 17:32 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/67494 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T17:32:21.478134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T17:32:36.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-rc.2"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.15"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.22"
},
{
"status": "affected",
"version": "\u003e= 19.0.0-next.0, \u003c 19.2.23"
},
{
"status": "affected",
"version": "\u003c= 18.2.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips the strict, client-defined request redirect policy configuration (such as redirect: \u0027error\u0027), falling back to the browser\u0027s default \u0027follow\u0027 strategy. If the target web application makes client-side requests with a strict policy (e.g., expecting a network error instead of automatically following redirects), the service worker will bypass this instruction and automatically follow HTTP 3xx redirects to other destinations. This acts as an unintended proxy/intermediary (\"Confused Deputy\") and can result in cookie/credential exposure or same-origin session-restricted data leakage if public dynamic routes redirect to sensitive routes. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T15:46:26.364Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-gv2q-mqqv-365m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-gv2q-mqqv-365m"
},
{
"name": "https://github.com/angular/angular/pull/67494",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/67494"
}
],
"source": {
"advisory": "GHSA-gv2q-mqqv-365m",
"discovery": "UNKNOWN"
},
"title": "Angular Service Worker Policy-Bypass \u0026 Credential-Stripping Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50169",
"datePublished": "2026-06-22T15:41:17.125Z",
"dateReserved": "2026-06-03T20:54:20.433Z",
"dateUpdated": "2026-06-22T17:32:36.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101896 (GCVE-0-2026-101896)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:05 – Updated: 2026-10-14 15:05
VLAI
EPSS
VEX
Title
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.
Severity
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/70716 | x_refsource_MISC |
| https://github.com/angular/angular/pull/70717 | x_refsource_MISC |
| https://github.com/angular/angular/commit/03872a8… | x_refsource_MISC |
| https://github.com/angular/angular/commit/5af6121… | x_refsource_MISC |
| https://github.com/angular/angular/commit/ddfe210… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.2.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.32"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.24"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.2.0"
}
]
},
{
"product": "router",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.32"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.24"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:05:42.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3"
},
{
"name": "https://github.com/angular/angular/issues/70716",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/70716"
},
{
"name": "https://github.com/angular/angular/pull/70717",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/70717"
},
{
"name": "https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583"
},
{
"name": "https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d"
},
{
"name": "https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.32"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.24"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.2.0"
}
],
"source": {
"advisory": "GHSA-ff3f-86qr-9cv3",
"discovery": "UNKNOWN"
},
"title": "Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101896",
"datePublished": "2026-10-14T15:05:42.934Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-10-14T15:05:42.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101897 (GCVE-0-2026-101897)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:03 – Updated: 2026-10-14 15:03
VLAI
EPSS
VEX
Title
Angular DevTools (Local DoS)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.
Severity
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/70623 | x_refsource_MISC |
| https://github.com/angular/angular/commit/7c05359… | x_refsource_MISC |
| https://github.com/angular/angular/commit/cf492e8… | x_refsource_MISC |
| https://github.com/angular/angular/commit/e02c4d8… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 22.2.0-rc.0"
}
]
},
{
"product": "DevTools",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.20.0, \u003c 1.21.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-940",
"description": "CWE-940: Improper Verification of Source of a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:03:36.405Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c"
},
{
"name": "https://github.com/angular/angular/pull/70623",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/70623"
},
{
"name": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d"
},
{
"name": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f"
},
{
"name": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3"
}
],
"source": {
"advisory": "GHSA-r653-wxfp-pp9c",
"discovery": "UNKNOWN"
},
"title": "Angular DevTools (Local DoS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101897",
"datePublished": "2026-10-14T15:03:36.405Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-10-14T15:03:36.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101895 (GCVE-0-2026-101895)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:00 – Updated: 2026-10-14 15:00
VLAI
EPSS
VEX
Title
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
Severity
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/commit/3db26e2… | x_refsource_MISC |
| https://github.com/angular/angular/commit/fc2e8fb… | x_refsource_MISC |
| https://github.com/angular/domino/commit/4d974731… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.6 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
<= 19.2.25
Affected: >= 20.0.0, < 20.3.31 Affected: >= 21.0.0, < 21.2.23 Affected: >= 22.0.0, < 22.1.6 |
|
| @angular/ | platform-server |
Affected:
<= 19.2.25
Affected: >= 20.0.0, < 20.3.31 Affected: >= 21.0.0, < 21.2.23 Affected: >= 22.0.0, < 22.1.6 |
{
"containers": {
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.31"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.23"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.6"
}
]
},
{
"product": "platform-server",
"vendor": "@angular/",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.31"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.23"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:00:14.385Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-f67j-2jqw-jpq7"
},
{
"name": "https://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/3db26e2544964d07a520836ad01f02f36ec88e25"
},
{
"name": "https://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/fc2e8fbc0bda2f5c11585e8a0cbd88c074f5e567"
},
{
"name": "https://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/4d97473116d000e3fd4d6f75ec98cbd67576fa6f"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.31"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.23"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.6"
}
],
"source": {
"advisory": "GHSA-f67j-2jqw-jpq7",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101895",
"datePublished": "2026-10-14T15:00:14.385Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-10-14T15:00:14.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104871 (GCVE-0-2026-104871)
Vulnerability from cvelistv5 – Published: 2026-10-02 19:43 – Updated: 2026-10-02 20:12
VLAI
EPSS
VEX
Title
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Summary
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 20:12 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular-cli/security/a… | x_refsource_CONFIRM |
| https://github.com/angular/angular-cli/commit/645… | x_refsource_MISC |
| https://github.com/angular/angular-cli/commit/707… | x_refsource_MISC |
| https://github.com/angular/angular-cli/commit/bb7… | x_refsource_MISC |
| https://github.com/angular/angular-cli/commit/c3e… | x_refsource_MISC |
| https://github.com/angular/angular-cli/releases/t… | x_refsource_MISC |
| https://github.com/angular/angular-cli/releases/t… | x_refsource_MISC |
| https://github.com/angular/angular-cli/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular-cli |
Affected:
< 20.3.36
Affected: >= 21.0.0, < 21.2.23 Affected: >= 22.0.0, < 22.1.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104871",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T20:12:27.563771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T20:12:49.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular-cli",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.36"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.23"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T19:43:50.475Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q"
},
{
"name": "https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2"
},
{
"name": "https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755"
},
{
"name": "https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841"
},
{
"name": "https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914"
},
{
"name": "https://github.com/angular/angular-cli/releases/tag/v20.3.36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/releases/tag/v20.3.36"
},
{
"name": "https://github.com/angular/angular-cli/releases/tag/v21.2.23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/releases/tag/v21.2.23"
},
{
"name": "https://github.com/angular/angular-cli/releases/tag/v22.1.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular-cli/releases/tag/v22.1.7"
}
],
"source": {
"advisory": "GHSA-7g7c-h8rr-7p6q",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104871",
"datePublished": "2026-10-02T19:43:50.475Z",
"dateReserved": "2026-10-02T14:59:11.775Z",
"dateUpdated": "2026-10-02T20:12:49.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88060 (GCVE-0-2026-88060)
Vulnerability from cvelistv5 – Published: 2026-09-10 19:04 – Updated: 2026-09-10 19:20
VLAI
EPSS
VEX
Title
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 19:19 UTC
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/commit/73d8bbd… | x_refsource_MISC |
| https://github.com/angular/angular/commit/89b2056… | x_refsource_MISC |
| https://github.com/angular/angular/commit/ba3bc47… | x_refsource_MISC |
| https://github.com/angular/domino/commit/04f987dc… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88060",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T19:19:47.937061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T19:20:56.297Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.30"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.22"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer\u0027s fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T19:04:17.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
},
{
"name": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915"
},
{
"name": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
},
{
"name": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
},
{
"name": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.30"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.22"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.4"
}
],
"source": {
"advisory": "GHSA-v3p8-whq6-r5jg",
"discovery": "UNKNOWN"
},
"title": "Angular: SSR XSS via Unescaped \u003ctemplate\u003e Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88060",
"datePublished": "2026-09-10T19:04:17.420Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-10T19:20:56.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88059 (GCVE-0-2026-88059)
Vulnerability from cvelistv5 – Published: 2026-09-10 19:00 – Updated: 2026-09-11 17:50
VLAI
EPSS
VEX
Title
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 17:49 UTC
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/69777 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69778 | x_refsource_MISC |
| https://github.com/angular/angular/commit/c45028e… | x_refsource_MISC |
| https://github.com/angular/angular/commit/caf6166… | x_refsource_MISC |
| https://github.com/angular/angular/commit/e4c416c… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T17:49:17.182667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T17:50:22.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.28"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.20"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular\u0027s @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user\u0027s sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T19:00:12.376Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c"
},
{
"name": "https://github.com/angular/angular/issues/69777",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/69777"
},
{
"name": "https://github.com/angular/angular/pull/69778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69778"
},
{
"name": "https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af"
},
{
"name": "https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d"
},
{
"name": "https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.28"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.20",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.20"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.1"
}
],
"source": {
"advisory": "GHSA-p297-fm68-3q8c",
"discovery": "UNKNOWN"
},
"title": "Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88059",
"datePublished": "2026-09-10T19:00:12.376Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-11T17:50:22.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88058 (GCVE-0-2026-88058)
Vulnerability from cvelistv5 – Published: 2026-09-10 18:56 – Updated: 2026-09-11 15:14
VLAI
EPSS
VEX
Title
Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 15:14 UTC
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/70146 | x_refsource_MISC |
| https://github.com/angular/angular/commit/73d8bbd… | x_refsource_MISC |
| https://github.com/angular/angular/commit/89b2056… | x_refsource_MISC |
| https://github.com/angular/angular/commit/ba3bc47… | x_refsource_MISC |
| https://github.com/angular/domino/commit/04f987dc… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88058",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T15:14:28.505071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T15:14:37.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/issues/70146"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.30"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.22"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim\u0027s browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:56:03.369Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4"
},
{
"name": "https://github.com/angular/angular/issues/70146",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/70146"
},
{
"name": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915"
},
{
"name": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
},
{
"name": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
},
{
"name": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.30"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.22"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.4"
}
],
"source": {
"advisory": "GHSA-j3r3-mxqp-r2p4",
"discovery": "UNKNOWN"
},
"title": "Angular: SSR XSS via Unescaped Processing Instruction (\u003c?...?\u003e) Nodes in Fallback Raw-Content Elements"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88058",
"datePublished": "2026-09-10T18:56:03.369Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-11T15:14:37.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88057 (GCVE-0-2026-88057)
Vulnerability from cvelistv5 – Published: 2026-09-10 18:46 – Updated: 2026-09-11 20:32
VLAI
EPSS
VEX
Title
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 16:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/issues/69550 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69558 | x_refsource_MISC |
| https://github.com/angular/angular/commit/2f96c80… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6afe6fa… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6caa298… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T16:34:33.902581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:32:49.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.28"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.20"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular\u0027s compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular\u0027s built-in sanitizer and execute arbitrary JavaScript in the user\u0027s browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:46:51.847Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg"
},
{
"name": "https://github.com/angular/angular/issues/69550",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/issues/69550"
},
{
"name": "https://github.com/angular/angular/pull/69558",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69558"
},
{
"name": "https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264"
},
{
"name": "https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee"
},
{
"name": "https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.28"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.20",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.20"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.0"
}
],
"source": {
"advisory": "GHSA-hh8m-fm6v-7cvg",
"discovery": "UNKNOWN"
},
"title": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88057",
"datePublished": "2026-09-10T18:46:51.847Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-11T20:32:49.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88056 (GCVE-0-2026-88056)
Vulnerability from cvelistv5 – Published: 2026-09-10 18:42 – Updated: 2026-09-15 14:56
VLAI
EPSS
VEX
Title
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:56 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/commit/3e924cc… | x_refsource_MISC |
| https://github.com/angular/angular/commit/5aa6d97… | x_refsource_MISC |
| https://github.com/angular/angular/commit/71e52d1… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v… | x_refsource_MISC |
| https://github.com/angular/angular/releases/tag/v22.1.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88056",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:56:19.499267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:56:52.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.25"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.3.30"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.2.22"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:42:34.054Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
},
{
"name": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c"
},
{
"name": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132"
},
{
"name": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970"
},
{
"name": "https://github.com/angular/angular/releases/tag/v20.3.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v20.3.30"
},
{
"name": "https://github.com/angular/angular/releases/tag/v21.2.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v21.2.22"
},
{
"name": "https://github.com/angular/angular/releases/tag/v22.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/releases/tag/v22.1.4"
}
],
"source": {
"advisory": "GHSA-f6mr-pjwc-34m4",
"discovery": "UNKNOWN"
},
"title": "Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88056",
"datePublished": "2026-09-10T18:42:34.054Z",
"dateReserved": "2026-09-09T21:22:45.434Z",
"dateUpdated": "2026-09-15T14:56:52.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69151 (GCVE-0-2026-69151)
Vulnerability from cvelistv5 – Published: 2026-08-03 16:23 – Updated: 2026-08-03 21:19
VLAI
EPSS
VEX
Title
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 21:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68821 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69306 | x_refsource_MISC |
| https://github.com/angular/angular/commit/417a407… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6c41f5c… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | compiler |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | core |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T21:17:58.775539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T21:19:24.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "compiler",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "core",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:23:34.121Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99"
},
{
"name": "https://github.com/angular/angular/pull/68821",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68821"
},
{
"name": "https://github.com/angular/angular/pull/69306",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69306"
},
{
"name": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e"
},
{
"name": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865"
}
],
"source": {
"advisory": "GHSA-jj27-h5hq-8x99",
"discovery": "UNKNOWN"
},
"title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69151",
"datePublished": "2026-08-03T16:23:34.121Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T21:19:24.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69149 (GCVE-0-2026-69149)
Vulnerability from cvelistv5 – Published: 2026-08-03 16:14 – Updated: 2026-08-03 20:33
VLAI
EPSS
VEX
Title
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/69675 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69714 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69929 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69930 | x_refsource_MISC |
| https://github.com/angular/domino/pull/32 | x_refsource_MISC |
| https://github.com/angular/domino/commit/f88e5aa4… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
|
| @angular | platform-server |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:33:37.200757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:33:46.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
},
{
"product": "platform-server",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (\u003ciframe\u003e, \u003cnoembed\u003e, \u003cnoframes\u003e, and \u003cnoscript\u003e). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:14:39.636Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
},
{
"name": "https://github.com/angular/angular/pull/69675",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69675"
},
{
"name": "https://github.com/angular/angular/pull/69714",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69714"
},
{
"name": "https://github.com/angular/angular/pull/69929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69929"
},
{
"name": "https://github.com/angular/angular/pull/69930",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69930"
},
{
"name": "https://github.com/angular/domino/pull/32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/pull/32"
},
{
"name": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
}
],
"source": {
"advisory": "GHSA-vpx6-8pjr-4g3v",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69149",
"datePublished": "2026-08-03T16:14:39.636Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T20:33:46.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68945 (GCVE-0-2026-68945)
Vulnerability from cvelistv5 – Published: 2026-08-03 15:58 – Updated: 2026-08-03 16:58
VLAI
EPSS
VEX
Title
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 16:58 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68571 | x_refsource_MISC |
| https://github.com/angular/angular/commit/6867f77… | x_refsource_MISC |
| https://github.com/angular/angular/commit/948a8d6… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a64e288… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a6c7fc5… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T16:58:17.198889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:58:26.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
},
{
"product": "common",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:58:02.299Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
},
{
"name": "https://github.com/angular/angular/pull/68571",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68571"
},
{
"name": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
},
{
"name": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
},
{
"name": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
},
{
"name": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
}
],
"source": {
"advisory": "GHSA-jhpw-976m-542j",
"discovery": "UNKNOWN"
},
"title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68945",
"datePublished": "2026-08-03T15:58:02.299Z",
"dateReserved": "2026-07-31T21:49:24.928Z",
"dateUpdated": "2026-08-03T16:58:26.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}