CVE-2026-88057 angular CVE debrief

Who should care

Defenders responsible for Angular applications, particularly those using versions prior to 20.3.28, 21.2.20, and 22.1.0, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or secure Angular applications.

Why it matters

CVE-2026-88057 allows attacker-controlled values to reach DOM attributes without Angular's built-in sanitizer, potentially executing arbitrary JavaScript. Defenders should assess exposure and prioritize remediation for applications using vulnerable Angular versions.

• Potential execution of arbitrary JavaScript in the user's browser context
• Security-sensitive directive host bindings can be exploited
• Applications using vulnerable Angular versions are at risk
• Remediation priority for applications using vulnerable versions

Technical summary

The Angular compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...).

Defensive priority

Defenders should prioritize assessment and remediation of Angular applications using versions prior to 20.3.28, 21.2.20, and 22.1.0, as these are vulnerable to security-sensitive directive host bindings issues.

Recommended defensive actions

• Assess exposure of Angular applications using versions prior to 20.3.28, 21.2.20, and 22.1.0
• Apply updates to vulnerable Angular applications
• Use DomSanitizer.sanitize with SecurityContext.URL before assignment for applications unable to upgrade
• Restrict inputs to validated HTTP and HTTPS URL schemes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in Angular's compiler and runtime. The issue allows attacker-controlled values to reach DOM attributes without Angular's built-in sanitizer, potentially executing arbitrary JavaScript.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.