CVE-2026-11998: AngularJS Cross-Site Scripting Vulnerability in Deprecated Package
Summary
CVE-2026-11998: Angular's deprecated package has a Cross-Site Scripting issue. Affects angular versions >= 1.2.0-rc.3, <= 1.8.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AngularJS is a widely used open-source web application framework maintained by Google, designed to facilitate the development of dynamic web applications. It allows developers to create single-page applications using HTML as the template language and extends HTML's syntax to express application components clearly and succinctly. Despite its powerful features, AngularJS has been declared End-of-Life, meaning it no longer receives updates or support, making it vulnerable to security issues such as the one described here.
Vulnerability Detail
A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows attackers to bypass certain SCE policies for resource URLs. This can lead to arbitrary JavaScript execution within the victim's browser session. The vulnerability arises from the logic that matches entire URLs against regular expressions, which can result in partial matches for certain types of regex patterns. This flaw affects AngularJS versions greater than or equal to 1.2.0-rc.3 and can have severe implications, including unauthorized access to sensitive data and the execution of malicious scripts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there are no patches available due to the End-of-Life status of AngularJS, the best workaround is to avoid using AngularJS for new projects and to migrate existing applications to a more secure and supported framework. Additionally, ensure that any user input is properly sanitized to mitigate the risk of XSS attacks.
Conclusion
The vulnerability identified as CVE-2026-11998 in AngularJS poses a significant risk due to its potential for Cross-Site Scripting attacks. With AngularJS being End-of-Life, users are strongly encouraged to migrate to supported frameworks to ensure ongoing security. Regular monitoring and adherence to best practices in web security are essential to mitigate risks associated with deprecated software.
See every vulnerability recorded for angular →
FAQ
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
All versions of AngularJS greater than or equal to 1.2.0-rc.3 are affected by this vulnerability.
End-of-Life means that AngularJS will no longer receive updates, including security patches, making it vulnerable to new threats.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If migration is not feasible, ensure that you implement strong input validation and sanitization practices to reduce the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for angular.
