JSRat-Py

JSRat-Py This is my implementation of JSRat.ps1 in Python so you can now run the attack server from any OS instead of being limited to a Windows OS with Powershell enabled. Added support to handle client invocation via either rundll32 or regsvr32 methods References & Original Project: regsvr32:...

CVE-2026-111754

A flaw was found in @angular/platform-server. This vulnerability allows an unauthenticated remote attacker to trigger an open redirect, sending users to an attacker-controlled external domain. When server-side rendering SSR is enabled, validation checks for protocol-relative links occur before...

CVE-2026-88060

A flaw was found in @angular/platform-server. Untrusted input in server-side rendered SSR templates, specifically within fallback raw-content elements like noscript or iframe, is not properly escaped. This allows a remote attacker to inject malicious code by crafting input that includes unescaped...

CVE-2026-101895

A flaw was found in Angular's platform-server component. When performing Server-Side Rendering SSR, the HTML parser fails to properly handle malformed DOCTYPE declarations that end with trailing whitespace, leading to an infinite processing loop. A remote, unauthenticated attacker can exploit thi...

CVE-2026-111754

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

CVE-2026-111754

The @angular/platform-server and @angular/ssr packages are vulnerable to an Open Redirect vulnerability in Server-Side Rendering (SSR) environments. The root cause is that ServerPlatformLocation performs protocol-relative URL checks before WHATWG URL normalization. Attackers can provide a request...

CVE-2026-111754 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

CVE-2026-111754

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-111754 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-111754 Source advisory: MEND:CVE-2026-111754...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-111754 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-111754 Source advisory: MEND:CVE-2026-111754...

CVE-2026-111754 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-111754 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-111754 Source advisory: OSV:GHSA-W739-GVWX-GRC3...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-111754 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-111754 Source advisory: GHSA-W739-GVWX-GRC3...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-111754 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-111754 Source advisory: OSV:GHSA-W739-GVWX-GRC3...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-111754 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-111754 Source advisory: GHSA-W739-GVWX-GRC3...

Open Redirect

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Open Redirect via the resolveUrl function in packages/platform-server/src/url.ts, where WHATWG URL dot-segment normalization is applied after the raw-string...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-111754 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-111754 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-21347776...

GHSA-W739-GVWX-GRC3 @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

PT-2026-118577

Name of the Vulnerable Software and Affected Versions Angular versions prior to 20.3.33 Angular versions prior to 21.2.25 Angular versions prior to 22.2.1 Description An open redirect issue exists in @angular/platform-server when Server-Side Rendering SSR is enabled. The ServerPlatformLocation...