CVE-2026-11998: Google AngularJS XSS bypass in Strict Contextual Escaping

CVE-2026-11998 · Severity: high · CVSS 7.6 · Published 2026-06-24

A security flaw has been identified in AngularJS, a widely used framework for building web applications. The vulnerability exists in the component responsible for ensuring that only safe web addresses (URLs) are used for loading scripts and content. An attacker could exploit this to run malicious code in a user's browser, potentially leading to the theft of sensitive session information or unauthorized actions on behalf of the user.

Technologies: angular (npm). Vendors: npm.

Quick answers

Is CVE-2026-11998 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11998 being exploited in the wild.
How severe is CVE-2026-11998?
High severity, with a CVSS score of 7.6, published 24 June 2026.
Which products and versions are affected?
angular (npm) >= 1.2.0-rc.3, <= 1.8.3, SEMVER:introduced=1.2.0-rc.3,last_affected=1.8.3.
Is there a fix for CVE-2026-11998?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11998 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-11998?
Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the AngularJS Strict Contextual Escaping (SCE) module. The root cause is a flaw in the logic used to validate resource URLs against regular expression matchers, which can result in partial matches. This allows an attacker to bypass security policies and inject unsafe values into sensitive contexts such as script tags, iframes, or route templates. Exploitation requires a victim to interact with a malicious link or page. As the AngularJS project is End-of-Life (EOL), no official patches will be released.

Affected products

  • AngularJS angular >= 1.2.0-rc.3, <= 1.8.3

Identifiers

  • CVE-2026-11998
  • GHSA-7x27-g8rg-x87w

Timeline

  • 2026-06-24: disclosed: NVD publication date
  • 2026-06-24: advisory: GitHub Advisory published
  • 2026-07-17: other: Advisory updated and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.