TI-2026-60077 Aliases CVE-2026-88057 GHSA-hh8m-fm6v-7cvg

Cross-site scripting in angular

LOW 30CWE-79Published 2026-09-10 · Updated 2026-09-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Partial Red Hat: 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00372 31st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial angular (angular): 20.3.28, 21.2.20, 22.1.0@angular/core (npm): 22.1.0, 21.2.20, 20.3.28+1 more productRed Hat: 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
angular	angular	up to 19.2.25; 20.0.0 to before 20.3.28; 21.0.0 to before 21.2.20; 22.0.0 to before 22.1.0	20.3.28, 21.2.20, 22.1.0	Patch available	CNA
—	@angular/core (npm)	22.0.0 to before 22.1.0	22.1.0	Patch available	GHSA-hh8m-fm6v-7cvg
—	@angular/compiler (npm)	22.0.0 to before 22.1.0	22.1.0	Patch available	GHSA-hh8m-fm6v-7cvg
—	@angular/core (npm)	21.0.0 to before 21.2.20	21.2.20	Patch available	GHSA-hh8m-fm6v-7cvg
—	@angular/compiler (npm)	21.0.0 to before 21.2.20	21.2.20	Patch available	GHSA-hh8m-fm6v-7cvg
—	@angular/core (npm)	20.0.0 to before 20.3.28	20.3.28	Patch available	GHSA-hh8m-fm6v-7cvg
—	@angular/compiler (npm)	20.0.0 to before 20.3.28	20.3.28	Patch available	GHSA-hh8m-fm6v-7cvg
—	@angular/core (npm)	up to 19.2.25	—	No fix listed	GHSA-hh8m-fm6v-7cvg
—	@angular/compiler (npm)	up to 19.2.25	—	No fix listed	GHSA-hh8m-fm6v-7cvg

angular Vendorangular Affected up to 19.2.25; 20.0.0 to before 20.3.28; 21.0.0 to before 21.2.20; 22.0.0 to before 22.1.0 Fixed in 20.3.28, 21.2.20, 22.1.0 Patch available CNA
@angular/core (npm) Vendor— Affected 22.0.0 to before 22.1.0 Fixed in 22.1.0 Patch available GHSA-hh8m-fm6v-7cvg
@angular/compiler (npm) Vendor— Affected 22.0.0 to before 22.1.0 Fixed in 22.1.0 Patch available GHSA-hh8m-fm6v-7cvg
@angular/core (npm) Vendor— Affected 21.0.0 to before 21.2.20 Fixed in 21.2.20 Patch available GHSA-hh8m-fm6v-7cvg
@angular/compiler (npm) Vendor— Affected 21.0.0 to before 21.2.20 Fixed in 21.2.20 Patch available GHSA-hh8m-fm6v-7cvg
@angular/core (npm) Vendor— Affected 20.0.0 to before 20.3.28 Fixed in 20.3.28 Patch available GHSA-hh8m-fm6v-7cvg
@angular/compiler (npm) Vendor— Affected 20.0.0 to before 20.3.28 Fixed in 20.3.28 Patch available GHSA-hh8m-fm6v-7cvg
@angular/core (npm) Vendor— Affected up to 19.2.25 Fixed in — No fix listed GHSA-hh8m-fm6v-7cvg
@angular/compiler (npm) Vendor— Affected up to 19.2.25 Fixed in — No fix listed GHSA-hh8m-fm6v-7cvg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:angular:angular::::::node.js::*	19.0.0 – 19.2.25; 20.0.0 to before 20.3.28; 21.0.0 to before 21.2.20; 22.0.0 to before 22.1.0	Vulnerable	angular

cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* Versions 19.0.0 – 19.2.25; 20.0.0 to before 20.3.28; 21.0.0 to before 21.2.20; 22.0.0 to before 22.1.0 Vulnerable ·angular

Remediation

Fix · CNA angular (angular) Fixed in 20.3.28, 21.2.20, 22.1.0
Fix · GHSA-hh8m-fm6v-7cvg @angular/core (npm) Fixed in 22.1.0 Advisory →
Fix · GHSA-hh8m-fm6v-7cvg @angular/compiler (npm) Fixed in 22.1.0 Advisory →
Fix · GHSA-hh8m-fm6v-7cvg @angular/core (npm) Fixed in 21.2.20 Advisory →
Fix · GHSA-hh8m-fm6v-7cvg @angular/compiler (npm) Fixed in 21.2.20 Advisory →
Fix · GHSA-hh8m-fm6v-7cvg @angular/core (npm) Fixed in 20.3.28 Advisory →
Fix · GHSA-hh8m-fm6v-7cvg @angular/compiler (npm) Fixed in 20.3.28 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix planned: Out of support scope
Red Hat Ceph Storage 4	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat build of Apicurio Registry 3	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-88057
2026-10-03 Alias added: GHSA-hh8m-fm6v-7cvg

References

Exploit 1

https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg

Patch 5

Other 4

TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
TI-2026-36931 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CVSS 4.0HIGH 8.8
TI-2026-34131 Angular: SSRF via Hostname Hijacking in @angular/platform-server CVSS 4.0HIGH 8.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences