CVE-2026-88057 in Angular
Summary
by MITRE • 09/10/2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within the Angular framework represents a critical flaw in its security sanitization logic, specifically affecting how context is determined for directive host bindings prior to versions 20.3.28, 21.2.20, and 22.1.0. Angular relies on a robust sanitizer system to prevent Cross-Site Scripting by ensuring that dynamic content bound to the DOM adheres to safe contexts such as URL, HTML, or Style. However, in these affected versions, the compiler and runtime incorrectly derived the SecurityContext based on the declaring directive or component selector rather than evaluating the concrete host element where the binding is actually applied. This architectural oversight creates a discrepancy between the intended security context and the actual execution environment, allowing attacker-controlled data to bypass sanitization checks when specific composition patterns are utilized.
The technical root cause lies in the handling of complex component interactions within Angular's template engine. The flaw becomes exploitable through several distinct mechanisms including hostDirectives composition, inherited HostBinding declarations, dynamic directive application, and the use of createComponent with a custom hostElement. Additionally, SVG and MathML namespace elements as well as tag-neutral selectors like :not(...) can trigger this misalignment because they may resolve to different security contexts than those assumed by the compiler based on the original component definition. When an attacker controls values for attributes such as href, src, action, xlink:href, or data properties within these specific structural contexts, the framework fails to apply the necessary sanitization filters before writing the value to the DOM.
The operational impact of this vulnerability is severe, leading directly to Cross-Site Scripting attacks in the user's browser context. Because the sanitizer is omitted or incorrectly selected, malicious scripts embedded in attribute values are executed without restriction when the page renders. This allows an attacker to steal session cookies, hijack user sessions, perform actions on behalf of the victim, or redirect users to phishing sites. The attack vector typically involves convincing a user to interact with a crafted URL or content that triggers one of the vulnerable binding patterns within an Angular application, thereby executing arbitrary JavaScript code in the context of the trusted domain hosting the application.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, it maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter: JavaScript, as the exploitation involves injecting executable script code into a web page viewed by other users. The failure also reflects CWE-20, Improper Input Validation, where the application does not adequately validate or sanitize input based on its actual usage context within the DOM structure rather than just its source declaration.
To mitigate this risk, organizations must upgrade Angular to version 20.3.28, 21.2.20, or 22.1.0 and later, as these releases correct the SecurityContext derivation logic to accurately reflect the concrete host element context. For applications that cannot immediately upgrade due to dependency constraints or other operational limitations, a manual mitigation strategy involves explicitly sanitizing inputs before assignment. Developers should utilize DomSanitizer.sanitize with SecurityContext.URL for any dynamic values assigned to href, src, action, xlink:href, or similar attributes. Additionally, restricting user-supplied input to validated HTTP and HTTPS URL schemes can provide an additional layer of defense against script injection attempts in these specific binding scenarios until the framework update is applied.