Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and
    runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-
    sensitive directive host bindings because SecurityContext was derived from the declaring directive or
    component selector rather than the concrete host element. The mismatch is reachable through hostDirectives
    composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic
    directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-
    controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without
    Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications
    unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict
    inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and
    22.1.0. (CVE-2026-88057)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and     runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-     sensitive directive host bindings because SecurityContext was derived from the declaring directive or     component selector rather than the concrete host element. The mismatch is reachable through hostDirectives     composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic     directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-     controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without     Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications     unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict     inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and     22.1.0. (CVE-2026-88057)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447952	SCA: security update for @angular/compiler, @angular/core (GHSA-hh8m-fm6v-7cvg)	Tenable Cloud Security	SCA Checks	Local	medium
447952	SCA: security update for @angular/compiler, @angular/core (GHSA-hh8m-fm6v-7cvg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
344712	Linux Distros Unpatched Vulnerability : CVE-2026-88057	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88057

medium

Tenable Plugins

medium

medium

medium