@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +34 more potentially affected by CVE-2026-50557 via @angular/compiler (>=20.0.0-rc.0, <=20.3.21)

@angular/compiler NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-50557 Source...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +19 more potentially affected by CVE-2026-50557 via @angular/compiler (>=21.0.0-next.1, <=21.2.14)

@angular/compiler NPM version =21.0.0-next.1, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =0.19.0, =1.0.77-rc.1, =0.0.1, =0.5.11 - foliokit 0.0.0 and more Source cves: CVE-2026-50557 Source advisory:...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-50557 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-50557 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +54 more potentially affected by CVE-2026-50557 via @angular/core (>=21.0.0-next.1, <=21.2.14)

@angular/core NPM version =21.0.0-next.1, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-50557 Source advisory: OSV:GHSA-F3M7-GQXR-G87X...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +38 more potentially affected by CVE-2026-50557 via @angular/core (>=19.0.0-next.9, <=19.2.20)

@angular/core NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves:...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +37 more potentially affected by CVE-2026-50557 via @angular/compiler (>=19.0.0-next.9, <=19.2.17)

@angular/compiler NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =19.24.1, =19.43.0 and more Source cves: CVE-2026-50557 Source advisory:...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +34 more potentially affected by CVE-2026-50557 via @angular/compiler (>=20.0.0-rc.0, <=20.3.21)

@angular/compiler NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-50557 Source...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +19 more potentially affected by CVE-2026-50557 via @angular/compiler (>=21.0.0-next.1, <=21.2.14)

@angular/compiler NPM version =21.0.0-next.1, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =0.19.0, =1.0.77-rc.1, =0.0.1, =0.5.11 - foliokit 0.0.0 and more Source cves: CVE-2026-50557 Source advisory:...

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements e.g., or were not properly identified as script elements by the Angular template preparser,...

Cross-site Scripting (XSS)

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

GHSA-F3M7-GQXR-G87X Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements e.g., or were not properly identified as script elements by the Angular template preparser,...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-50556 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-50556 Source advisory: OSV:GHSA-GXX4-3XCV-F8QX...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50556 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50556 Source advisory: OSV:GHSA-GXX4-3XCV-F8QX...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-50556 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-50556 Source advisory: OSV:GHSA-GXX4-3XCV-F8QX...

@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of elements. When rendering dynamic text content inside a element via template bindings such as value or textContent, the template engine expects the browser ...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50556 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50556 Source advisory: GHSA-GXX4-3XCV-F8QX...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-50556 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-50556 Source advisory: GHSA-GXX4-3XCV-F8QX...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-50556 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-50556 Source advisory: GHSA-GXX4-3XCV-F8QX...

GHSA-GXX4-3XCV-F8QX @angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of elements. When rendering dynamic text content inside a element via template bindings such as value or textContent, the template engine expects the browser ...