Angular Development Platform Vulnerability in Core and Compiler
CVE-2026-88057
What is CVE-2026-88057?
The Angular development platform, specifically its compiler and core components, had a vulnerability that allowed an incorrect sanitizer to be selected during host bindings of directives. This misconfiguration stems from how the SecurityContext was derived from the directive's selector, rather than the actual host element. Attackers could exploit this gap through various means, such as using dynamic directives or specific host element attributes, potentially enabling arbitrary JavaScript execution in the user's browser. To mitigate this vulnerability, applications are encouraged to update to versions 20.3.28, 21.2.20, or 22.1.0, or alternatively, implement the DomSanitizer.sanitize method with appropriate inputs.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.28 < 20.0.0, 20.3.28
angular >= 21.0.0, < 21.2.20 < 21.0.0, 21.2.20