CyberSecBulletin
CVE-2026-11998NVD status: Awaiting Analysis

AngularJS: Incomplete Filtering of Special Elements

Published Updated By the CyberSecBulletin desk

CVE-2026-11998 is a high-severity incomplete filtering of special elements vulnerability in AngularJS from Google, with a CVSS 3.1 base score of 7.6 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. Affected AngularJS versions: >=1.2.0-rc.3. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.4% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of AngularJS you run against the affected versions below, and install the vendor's latest release.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
  3. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
GoogleAngularJS>=1.2.0-rc.3Not stated
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 7Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
Red HatRed Hat Fuse 7Not specified in the recordNot stated
Red HatRed Hat JBoss Enterprise Application Platform Expansion PackNot specified in the recordNot stated
Red HatRed Hat OpenStack Platform 16.2Not specified in the recordNot stated
Red HatRed Hat Quay 3Not specified in the recordNot stated
Red HatRed Hat Single Sign-On 7Not specified in the recordNot stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
LowLimited modification of data is possible.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.6HighCNA
CVSS 3.17.6HighCNA

Official description

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs. This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3. Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Incomplete Filtering of Special Elements

The product receives data from an upstream component, but it does not completely filter special elements before sending it to a downstream component.

More Incomplete Filtering of Special Elements vulnerabilities (CWE-791)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Incomplete Filtering of Special Elements vulnerabilities

Spotted an error? Tell us.