CVE-2026-88057

A flaw was found in Angular's @angular/core and @angular/compiler components. This vulnerability allows a remote attacker to bypass security sanitization mechanisms. By injecting malicious data into specific HTML attributes, an attacker can cause the application to execute arbitrary JavaScript co...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +44 more potentially affected by CVE-2026-88057 via @angular/core (>=20.0.0, <=20.3.25)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

Cross-site Scripting (XSS)

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.8), @bitblit/ngx-acute-common (>=6.1.210-alpha, <=6.1.222-alpha) +18 more potentially affected by CVE-2026-88057 via @angular/core (>=22.0.0, <=22.0.8)

@angular/core NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =23.0.0-alpha.2, =23.0.0-alpha.2, =0.0.0, =25.0.0 - @memobit/angular 1.0.1 - @nativescript/template-blank-ng 9.1.0 - @nativescript/template-drawer-navigation-ng 9.1.0 - @nativescript/template-hello-world-ng 9.1.0 -...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +57 more potentially affected by CVE-2026-88057 via @angular/core (>=21.0.0, <=21.2.19)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +332 more potentially affected by CVE-2026-88057 via @angular/core (>=19.0.0, <=19.2.25)

@angular/core NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 and more Source cves: CVE-2026-88057 Source advisory: OSV:GHSA-HH8M-FM6V-7CVG...

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

DEBIAN-CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

PT-2026-89561

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

CVE-2026-88057: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +44 more potentially affected by CVE-2026-69151 via @angular/core (>=20.0.0, <=20.3.25)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +332 more potentially affected by CVE-2026-69151 via @angular/core (>=19.0.0, <=19.2.25)

@angular/core NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 and more Source cves: CVE-2026-69151 Source advisory: OSV:GHSA-JJ27-H5HQ-8X99...

ngx-mat-input-tel (22.0.0) potentially affected by CVE-2026-69151 via @angular/core (22.0.0)

@angular/core NPM version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/core and may be impacted: - ngx-mat-input-tel 22.0.0 Source cves: CVE-2026-69151 Source advisory: OSV:GHSA-JJ27-H5HQ-8X99...

CVE-2026-52725

A flaw was found in the @angular/core component. This vulnerability allows an attacker to bypass security restrictions when creating dynamic components. By manipulating the host element or selector, an attacker can force an Angular component to be mounted directly onto a script tag. This can resu...

CVE-2026-50557

A flaw was found in Angular's @angular/compiler and @angular/core packages. Namespaced script elements were not properly identified by the template preparser, and security context schema mappings did not consistently handle attributes within namespaced elements. An attacker who can inject templat...

Linux Distros Unpatched Vulnerability : CVE-2026-52725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.1...

DEBIAN-CVE-2026-52725

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component...

CVE-2026-52725: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component...

CVE-2026-50557: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute...

@agdo/object-model (>=1.0.1, <=1.2.34), @agilie/widget-template (>=1.0.2, <=1.1.6) +415 more potentially affected by CVE-2026-50557 via @angular/core (>=18.0.0, <=18.2.14)

@angular/core NPM version =18.0.0, =1.0.1, =1.0.2, =0.0.0, =1.0.0, =0.0.55, =1.0.0, =18.2.0, =7.0.0, =7.0.3 - @auscope/angular2parse 18.0.0 and more Source cves: CVE-2026-50557 Source advisory: OSV:GHSA-F3M7-GQXR-G87X...