CVE-2026-11998 AngularJS XSS via SCE resource URL sanitization bypass
Attacker can execute arbitrary JavaScript in victim's browser by bypassing AngularJS SCE resource URL sanitization policies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-11998?
CVE-2026-11998 is a high-severity cross-site scripting vulnerability in Google AngularJS, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.
SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.
This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.
Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .
Which versions are affected by CVE-2026-11998?
2 open source packages ship an affected version, including angular.
| Package | Affected | Fixed in |
|---|---|---|
angular npm | From 1.2.0-rc.3 to 1.8.3 | None |
angular npm | From 1.2.0-rc.3 to 1.8.3 | None |
How do I fix CVE-2026-11998?
Product is end of life, replace it.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-11998 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11998 exists.
Sources
Also known as CLSA-2026-1784769553, CLSA-2026-1784769554, CLSA-2026-1784769558, CLSA-2026-1784769564, CLSA-2026-1784769597, DEBIAN-CVE-2026-11998 and 3 more.