CVE-2026-88057 Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Attackers can execute arbitrary JavaScript in user browsers by bypassing Angular's sanitization on specific host bindings, affecting all Angular applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-88057?
CVE-2026-88057 is a medium-severity cross-site scripting vulnerability in angular, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-88057?
16 open source packages ship an affected version, including @angular/compiler and @angular/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@angular/compiler npm | All versions to 19.2.25 | None |
@angular/compiler npm | All versions to 19.2.25 | None |
@angular/compiler npm | From 20.0.0 | 20.3.28 |
@angular/compiler npm | From 20.0.0 | 20.3.28 |
@angular/compiler npm | From 21.0.0 | 21.2.20 |
@angular/compiler npm | From 21.0.0 | 21.2.20 |
10 more packages
@angular/compiler npm | From 22.0.0 | 22.1.0 |
@angular/compiler npm | From 22.0.0 | 22.1.0 |
@angular/core npm | All versions to 19.2.25 | None |
@angular/core npm | All versions to 19.2.25 | None |
@angular/core npm | From 20.0.0 | 20.3.28 |
@angular/core npm | From 20.0.0 | 20.3.28 |
@angular/core npm | From 21.0.0 | 21.2.20 |
@angular/core npm | From 21.0.0 | 21.2.20 |
@angular/core npm | From 22.0.0 | 22.1.0 |
@angular/core npm | From 22.0.0 | 22.1.0 |
Products include Angular Angular.
How do I fix CVE-2026-88057?
Upgrade @angular/compiler to a fixed version for your release line: 20.3.28, 21.2.20 or 22.1.0.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-88057 being exploited?
There is no known exploitation of CVE-2026-88057 in the wild and no public exploit code.
Other vulnerabilities in angular
- CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
- CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
- CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-41423 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Sources
Also known as CLSA-2026-1790416421, CLSA-2026-1790431292, CLSA-2026-1790444995, CLSA-2026-1790468982, CLSA-2026-1790479328, CLSA-2026-1792161348 and 16 more.