Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-7x27-g8rg-x87w
Advisory ID github_osv/GHSA-7x27-g8rg-x87w
Aliases CVE-2026-11998
Summary Angular's deprecated package has a Cross-Site Scripting issue A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs. This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3. Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the  End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-791 Incomplete Filtering of Special Elements
System Score Found at
cvssv3.1 7.6 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7x27-g8rg-x87w/GHSA-7x27-g8rg-x87w.json
generic_textual HIGH
Reference id Reference type URL
https://access.redhat.com/security/cve/CVE-2026-11998
https://bugzilla.redhat.com/show_bug.cgi?id=2492579
https://github.com/angular/angular.js
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json
https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs
5b3896f56fab66f20cd25e698cf3faa8 Exploit https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8
cve-2026-11998 Advisory https://www.herodevs.com/vulnerability-directory/cve-2026-11998
CVE-2026-11998 https://nvd.nist.gov/vuln/detail/CVE-2026-11998
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7x27-g8rg-x87w/GHSA-7x27-g8rg-x87w.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-06-25T13:12:17Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/11xxx/CVE-2026-11998.json

Source Advisory: vulnrichment/CVE-2026-11998

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]