CVE-2026-88056Critical· 9.1▾ AbyssalPoC availableAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processe…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Exploit / PoC code exists
0.4% → 0.6%
Last analysed / modified upstream
8.6 → 9.1
high → critical
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
angular >= 19.0.0, <= 19.2.25angular >= 20.0.0, < 20.3.30angular >= 21.0.0, < 21.2.22angular >= 22.0.0, < 22.1.4Upgrade past the affected range:
angular 22.1.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88058Medium· 6.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-88060Medium· 6.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2026-101897Medium· 5.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-88057Medium· 6.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-88059Medium· 4.0Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages