Skip to content
OpenAdvisories
High WID-SEC-2026-3318 5 CVEs

Angular: Mehrere Schwachstellen

Published Sep 10, 2026 · Updated Sep 10, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.

Product

Angular ist ein TypeScript-basiertes Front-End-Webapplikationsframework. Es ist eine Weiterentwicklung des JavaScript basierten AngularJS.

Vulnerabilities 5

  • High 8.6
    CVE-2026-88056

    Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled reso…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.6
    CVE-2026-88058

    Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingIns…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.6
    CVE-2026-88060

    Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted inp…

    angular angular angular.js angular.js Debian Ubuntu npm
  • Medium 5.3
    CVE-2026-88057

    Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or sele…

    angular angular katib-suggestion-hyperopt angular.js Debian Ubuntu Wolfi npm
  • Medium 4.0
    CVE-2026-88059

    Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Ser…

    angular angular katib-suggestion-hyperopt angular.js Debian Ubuntu Wolfi npm

Revision history

  1. #1

    Initiale Fassung

References