CVE-2026-88057: Angular Core and Compiler - Sanitization Bypass via Directive Host Bindings

Background

Angular is a platform and framework for building single-page client applications using HTML and TypeScript. It provides a robust set of tools for developing dynamic web applications, including a powerful templating engine, dependency injection, and a rich ecosystem of libraries. However, Angular's handling of security-sensitive DOM sinks can be compromised if directives are improperly configured, leading to potential Cross-Site Scripting (XSS) vulnerabilities.

Vulnerability Detail

The vulnerability arises from Angular's method of determining the SecurityContext for directive host bindings, which is based solely on the declaring directive or component selector at compile time. This approach fails to account for the actual host element the directive is applied to, allowing an attacker to exploit this oversight. If a directive with a security-sensitive host binding is applied to an unexpected host element, untrusted inputs can be written directly to the DOM without proper sanitization, potentially enabling arbitrary JavaScript execution in the user's browser context.

npm install @angular/core@22.2.3

Workaround

As a temporary workaround, ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using the following code:

import { DomSanitizer, SecurityContext } from '@angular/platform-browser';

constructor(private sanitizer: DomSanitizer) {}

setSafeUrl(value: string) {
  return this.sanitizer.sanitize(SecurityContext.URL, value);
}

Conclusion

CVE-2026-88057 is a significant vulnerability affecting Angular's core and compiler packages, allowing for potential XSS attacks through improper handling of directive host bindings. It is crucial to update to the patched versions or implement the suggested workarounds to mitigate the risk.

See every vulnerability recorded for @angular/core →

FAQ