FLAT-1EVSS – Vulnerability | Fluid Attacks Database

Database

Description

Angular: SSR XSS via Unescaped

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	@angular/platform-server	>=22.0.0 <22.1.4 \|\| >=21.0.0 <21.2.22 \|\| >=20.0.0 <20.3.30 \|\| >=0 <=19.2.25	22.1.4, 21.2.22, 20.3.30
debian 12	angular.js	=1.8.3-1 \|\| =1.8.3-1+deb12u1 \|\| =1.8.3-1+deb12u1~deb11u1 \|\| =1.8.3-2 \|\| =1.8.3-3	-
debian 13	angular.js	=1.8.3-3	-

Aliases

1. CVE-2026-880602. NVD-2026-880603. OSV-2026-880604. OSV-DEBIAN-2026-880605. GHSA-v3p8-whq6-r5jg6. GCVE-2026-880607. SECURITY-TRACKER-CVE-2026-88060

References

1. https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg2. https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad9153. https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef4. https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e85. https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f6. https://github.com/angular/angular/releases/tag/v20.3.307. https://github.com/angular/angular/releases/tag/v21.2.228. https://github.com/angular/angular/releases/tag/v22.1.4

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.