CVE-2026-88057: Angular sanitization bypass in directive host bindings

CVE-2026-88057 · Severity: medium · CVSS 4 · Published 2026-09-10

Angular is a widely-used web application framework that protects applications against malicious scripts (XSS attacks) by automatically cleaning untrusted data before it's rendered. This vulnerability allows attackers to bypass that protection in specific cases where directives bind data to security-sensitive attributes like href or src. If an attacker can control the data being passed to an affected directive, they can inject malicious JavaScript code that executes in users' browsers, leading to account compromise, data theft, or unauthorized actions.

Technologies: @angular/compiler (npm), @angular/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-88057 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88057 being exploited in the wild.
How severe is CVE-2026-88057?
Medium severity, with a CVSS score of 4, published 10 September 2026.
Which products and versions are affected?
@angular/compiler (npm) SEMVER:introduced=22.0.0,fixed=22.1.0; @angular/core (npm) SEMVER:introduced=22.0.0,fixed=22.1.0.
Is there a fix for CVE-2026-88057?
Yes. @angular/compiler (npm): upgrade to 22.1.0 or later; @angular/core (npm): upgrade to 22.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88057 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88057?
Check whether you run @angular/compiler (npm) or @angular/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/compiler (npm): upgrade to 22.1.0 or later
    npm install @angular/compiler@22.1.0
  • @angular/core (npm): upgrade to 22.1.0 or later
    npm install @angular/core@22.1.0

Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in Angular's compiler and runtime sanitization. The root cause is that the compiler determines the SecurityContext for directive host bindings (e.g., `@HostBinding('attr.href')` or `host: {'[attr.href]': 'value'}`) based on the declaring directive's selector at compile time, rather than the concrete host element the directive is applied to. This leads to incorrect or missing sanitization when directives are applied to different concrete elements via hostDirectives composition, class inheritance, dynamic component instantiation, SVG/MathML namespaces, or tag-neutral selectors. Untrusted inputs like `javascript:...` URLs bypass the built-in sanitizer and are written to DOM attributes as-is. The attack requires network access and user interaction (passive), and no authentication or special privileges. Patches have been released in versions 22.1.0, 21.2.20, and 20.3.28; version 19.2.25 and earlier lack patches and remain vulnerable.

Affected products

  • Google @angular/core 20.0.0–20.3.27, 21.0.0–21.2.19, 22.0.0–22.0.x, <=19.2.25
  • Google @angular/compiler 20.0.0–20.3.27, 21.0.0–21.2.19, 22.0.0–22.0.x, <=19.2.25

Identifiers

  • CVE-2026-88057
  • GHSA-hh8m-fm6v-7cvg

Timeline

  • 2026-09-10: disclosed: GHSA-hh8m-fm6v-7cvg published
  • 2026: patched: Patches released in versions 22.1.0, 21.2.20, 20.3.28

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.