CVE-2026-11998

Awaiting Analysis Awaiting Analysis - Queue

AngularJS SCE Policy Bypass Leads to XSS

Publication date: 2026-06-24

Last updated on: 2026-07-09

Assigner: HeroDevs

Description

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs. This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3. Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-09

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-13

NVD

CVE-2026-11998

Affected Vendors & Products

Vendor	Product	Version / Range
angularjs	angularjs	From 1.2.0-rc.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-791	The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in AngularJS's Strict Contextual Escaping (SCE) logic that allows bypassing certain SCE policies for resource URLs.

SCE is designed to ensure that only trusted or safe values are used in security-sensitive contexts such as resource URLs, including executable JavaScript scripts, iframe documents, and route templates.

The flaw arises because the logic that matches entire URLs against regular expression matchers can result in partial matches for some regular expressions, effectively bypassing the policies and allowing unsafe values to be used as resource URLs.

This can lead to arbitrary JavaScript execution within the context of the victim's browser session.

Mitigation Strategies

The AngularJS project is already End-of-Life and will not receive updates to address this issue.

Immediate mitigation steps include avoiding the use of vulnerable AngularJS versions (>= 1.2.0-rc.3) in your applications.

Consider migrating to a supported framework or version that does not have this vulnerability.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary JavaScript code within the victim's browser session.

Such arbitrary code execution can lead to a range of impacts including theft of sensitive information, session hijacking, and potentially further attacks on the victim's system or network.

Because the vulnerability allows bypassing security policies intended to restrict resource URLs, it undermines the security model of applications using AngularJS versions affected by this flaw.

Compliance Impact

This vulnerability allows attackers to execute arbitrary JavaScript within the victim's browser session, potentially leading to theft of sensitive data such as cookies or session tokens and modification of webpage content.

Such unauthorized access and data theft can result in violations of data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information.

Therefore, applications using vulnerable AngularJS versions may face compliance risks if this flaw is exploited, as it undermines the confidentiality and integrity of user data.

Hi! I’m here to help you understand CVE-2026-11998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70