Skip to content
Fencer Vulns
high 7.6

CVE-2026-11998 json

AngularJS XSS via SCE resource URL sanitization bypass

published 2026-06-24 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-39080 , GHSA-7x27-g8rg-x87w

cvss
7.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.

SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.

This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.

Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the  End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-11998 updated cvss 7.6

angularjs: AngularJS: Arbitrary JavaScript execution due to Strict Contextual Escaping (SCE) bypass

  • Red Hat Single Sign-On 7 angular
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 grafana, mozjs60, thunderbird, grafana-loki, grafana-mssql, grafana-mysql, +10 more Red Hat Enterprise Linux 9 gjs, firefox, grafana, firefox-x11, thunderbird, grafana-selinux Red Hat Enterprise Linux 10 gjs, firefox, grafana, thunderbird
    not affected: vulnerable code not in execute path
  • Red Hat Fuse 7 angular
    not affected: vulnerable code cannot be controlled by adversary
  • Red Hat JBoss Enterprise Application Platform Expansion Pack angular
    not affected: component not present
  • Red Hat OpenStack Platform 16.2 qpid-dispatch-tools, qpid-dispatch-router
    not affected: vulnerable code cannot be controlled by adversary
  • Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • codepen.io https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8 referenced PoC, tagged "exploit" by a source, unverified
  • herodevs.com https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
CISA ADP 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
GitHub 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm angular
>=1.2.0-rc.3, <=1.8.3
 no fix listed

Affected products

  • Google AngularJS
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat Quay 3
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-791 Incomplete Filtering of Special Elements
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.