CVE-2026-11998 AngularJS XSS via SCE resource URL sanitization bypass

🗓️ 24 Jun 2026 20:29:37Reported by GoogleType

osv🔗 osv.dev👁 3 Views

AngularJS SCE resource URL bypass lets unsafe resource URLs execute JavaScript due to a flawed URL matching; affected 1.2.0-rc.3 and later; project is end of life.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2026-11998	24 Jun 202620:29	–	attackerkb
Circl	CVE-2026-11998	24 Jun 202622:48	–	circl
CVE	CVE-2026-11998	24 Jun 202620:29	–	cve
Cvelist	CVE-2026-11998 AngularJS XSS via SCE resource URL sanitization bypass	24 Jun 202620:29	–	cvelist
Debian CVE	CVE-2026-11998	24 Jun 202620:29	–	debiancve
EUVD	EUVD-2026-39080	24 Jun 202620:29	–	euvd
NVD	CVE-2026-11998	24 Jun 202621:16	–	nvd
OSV	DEBIAN-CVE-2026-11998	24 Jun 202621:16	–	osv
OSV	UBUNTU-CVE-2026-11998	24 Jun 202621:16	–	osv
Positive Technologies	PT-2026-52086	24 Jun 202600:00	–	ptsecurity

Source	Link
registry	www.registry.npmjs.org/
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json
access	www.access.redhat.com/security/cve/CVE-2026-11998
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11998.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-11998
herodevs	www.herodevs.com/vulnerability-directory/cve-2026-11998
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/angular/angular.js
codepen	www.codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8
herodevs	www.herodevs.com/vulnerability-directory/cve-2026-11998

11 Jul 2026 03:54Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.6

EPSS0.00338