CVE-2026-88057
Awaiting Analysis Awaiting Analysis - Queue

Angular Framework DOM Sanitization Bypass

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88057
EUVD
EUVD-2026-75678

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
angular core 20.3.28
angular compiler 20.3.28
angular core 21.2.20
angular compiler 21.2.20
angular core 22.1.0
angular compiler 22.1.0
angular angular to 20.3.28 (inc)
angular angular to 21.2.20 (inc)
angular angular to 22.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sanitization bypass in Angular versions before 20.3.28, 21.2.20, and 22.1.0. It occurs when Angular's compiler selects an incorrect security context for directive host bindings, allowing untrusted inputs like javascript: URLs to bypass sanitization and execute arbitrary JavaScript. The issue arises from determining security context at compile time based on the directive or component selector rather than the actual host element.

Detection Guidance

Detecting this vulnerability requires checking Angular versions in use. Run commands like 'npm list @angular/core' or 'ng version' in your project directory to identify installed versions. Compare the output against patched versions 20.3.28, 21.2.20, or 22.1.0. If using older versions, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute malicious JavaScript in a user's browser by controlling values bound to affected directives. This could lead to data theft, session hijacking, or defacement of web applications using vulnerable Angular versions. The impact depends on the application's use of host bindings and user-controlled inputs.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR (e.g., Article 32 security of processing) or HIPAA (e.g., safeguards for protected health information). Exploitation may result in data breaches, requiring breach notification under these regulations.

Mitigation Strategies

Immediately upgrade Angular to versions 20.3.28, 21.2.20, or 22.1.0. If upgrading is not possible, apply workarounds like using DomSanitizer.sanitize with SecurityContext.URL before assigning values or restrict inputs to validated HTTP/HTTPS URL schemes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88057. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart