Skip to content
OpenAdvisories
High WID-SEC-2026-0534 3 CVEs

Angular SSR und Core: Mehrere Schwachstellen

Published Feb 25, 2026 · Updated Apr 26, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um falsche Informationen darzustellen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.

Product

Angular ist ein TypeScript-basiertes Front-End-Webapplikationsframework. Es ist eine Weiterentwicklung des JavaScript basierten AngularJS.

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-27739 Public exploit

    Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

    The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery (SSRF) vulnerability in the Angular SSR request handling pipeline. The vulnerability exist…

  • High 7.6

    Angular i18n vulnerable to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationali…

  • Medium 6.9

    Angular SSR has an Open Redirect via X-Forwarded-Prefix

    The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior t…

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References