Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.28, 21.x prior to 21.2.20 or 22.x prior to 22.1.0. It is, therefore, affected by a sanitization bypass vulnerability in @angular/core and @angular/compiler. The security context of directive host bindings is determined from the declaring directive selector rather than the concrete host element, allowing untrusted values (such as javascript: URLs) bound through host bindings to reach security-sensitive DOM attributes without sanitization, leading to Cross-Site Scripting (XSS). (CVE-2026-88057)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and
    runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-
    sensitive directive host bindings because SecurityContext was derived from the declaring directive or
    component selector rather than the concrete host element. The mismatch is reachable through hostDirectives
    composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic
    directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-
    controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without
    Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications
    unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict
    inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and
    22.1.0. (CVE-2026-88057)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and     runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-     sensitive directive host bindings because SecurityContext was derived from the declaring directive or     component selector rather than the concrete host element. The mismatch is reachable through hostDirectives     composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic     directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-     controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without     Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications     unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict     inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and     22.1.0. (CVE-2026-88057)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115588	Angular < 20.3.28 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium
115587	Angular 20.x < 20.3.28 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium
115586	Angular 21.x < 21.2.20 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium
115585	Angular 22.x < 22.1.0 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium
447952	SCA: security update for @angular/compiler, @angular/core (GHSA-hh8m-fm6v-7cvg)	Tenable Cloud Security	SCA Checks	Local	medium
447952	SCA: security update for @angular/compiler, @angular/core (GHSA-hh8m-fm6v-7cvg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
344712	Linux Distros Unpatched Vulnerability : CVE-2026-88057	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88057

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium