The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a     cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages     (International Components for Unicode), HTML from translated content was not properly sanitized and could     execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an     application in the source language, sending the messages to be translated, and then merging their     translations back into the final source code. Translations are frequently handled by contracts with     specific partner companies, and involve sending the source messages to a separate contractor before     receiving final translations for display to the end user. If the returned translations have malicious     content, it could be rendered into the application and execute arbitrary JavaScript. When successfully     exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application     origin. Depending on the nature of the application being exploited this could lead to credential     exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must     compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not     exploitable by arbitrary users. An attacker must first compromise an application's translation file before     they can escalate privileges into the Angular application client. The victim application must use Angular     i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content     security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is     applied, developers should consider reviewing and verifying translated content received from untrusted     third parties before incorporating it in an Angular application, enabling strict CSP controls to block     unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML     sanitization. (CVE-2026-27970)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-27970

high Nessus Plugin ID 300236

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Mar 4, 2026, 11:48 PM CVSS metrics ("CVSSv2 score" set to 4.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N") CVSSv2 severity (based on CVE-2026-27970, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202603042348
Version 1.2 Mar 4, 2026, 3:45 PM CVSS metrics ("CVSSv2 score" set to 3.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N") CVSS metrics ("Cvssv4 score" set to 7.6) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:U") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N") CVSSv2 severity (based on CVE-2026-27970, severity decreased from "Medium" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202603041545
Version 1.1 Mar 3, 2026, 6:06 AM New Plugin Feed: 202603030606