CVE-2026-123322

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

CVE-2026-123322

In JetBrains WebStorm versions prior to 2026.3 and 2026.2.4 , a vulnerability exists that allows for code execution within untrusted projects. The root cause is linked to the Angular CLI schematics loader (associated with CWE-829: Inclusion of Functionality from Untrusted Control Sphere ). The im...

EUVD-2026-118086

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

CVE-2026-123322

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

ngrev

ngrev Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run you...

CVE-2026-123322: JetBrains WebStorm: In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI…

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

Malicious code in angular-cli-library-builder (npm)

The package angular-cli-library-builder was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in angular-cli-autoprefixer (npm)

The package angular-cli-autoprefixer was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in amp-angular-cli (npm)

--- Credit: OpenSSF source...

@angular-devkit/build-angular (22.1.0-next.0), @oslokommune/auth-bff (>=2.0.1, <=2.2.1) +2 more potentially affected by CVE-2026-55602 via http-proxy-middleware (4.0.0)

http-proxy-middleware NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-middleware and may be impacted: - @angular-devkit/build-angular 22.1.0-next.0 - @oslokommune/auth-bff =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves:...

@aegis-scan/core (>=0.18.1, <=0.19.0), @aegis-scan/reporters (>=0.18.4, <=0.19.0) +441 more potentially affected by CVE-2026-9697 via undici (>=7.24.0, <=7.27.2)

undici NPM version =7.24.0, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.1.8, =0.1.7, =21.2.4, =21.2.4, =2.0.0-beta.3, =0.1.0, =0.18.0, =0.1.0, =0.4.0, =0.1.0, =1.0.1 and more Source cves: CVE-2026-9697 Source advisory: SNYK:JS-UNDICI-17372609...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33671 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33672 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33672 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33672 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33671 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33671 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

@abp/ng.schematics (>=9.3.0-rc.3, <=10.0.3), @ama-styling/style-dictionary (>=13.0.0-next.10, <=14.0.0-next.2) +14 more potentially affected by CVE-2026-27739 via @schematics/angular (>=20.0.0-next.0, <=20.3.16)

@schematics/angular NPM version =20.0.0-next.0, =9.3.0-rc.3, =13.0.0-next.10, =20.0.0-next.0, =20.0.0-next.0, =20.0.0-next.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.0.0-next.1, =13.0.0-next.10, =13.0.0-next.10, =0.0.1-alpha.564, =1.0.8, =1.0.9 -...

@angular/cli (>=21.2.0-next.0, <=21.2.0-next.2), @angular/create (>=21.2.0-next.0, <=21.2.0-next.2) +1 more potentially affected by CVE-2026-27739 via @schematics/angular (>=21.2.0-next.0, <=21.2.0-next.2)

@schematics/angular NPM version =21.2.0-next.0, =21.2.0-next.0, =21.2.0-next.0, =21.2.0-next.0, =21.2.0-next.2 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-SCHEMATICSANGULAR-15357313...

Angular code issue vulnerabilities

Angular is an open-source development platform created by Angular. It is used to build mobile and desktop web applications using TypeScript/JavaScript and other languages. There were code-related vulnerabilities in versions of Angular CLI prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21. These...