CVE-2026-88057

Executive Summary

CVE-2026-88057 is a sanitizer-bypass vulnerability affecting Angular's compiler and runtime packages (@angular/core and @angular/compiler) prior to versions 20.3.28, 21.2.20, and 22.1.0. The flaw occurs because the framework derives the SecurityContext for security-sensitive directive host bindings from the declaring directive or component selector rather than the concrete host element, causing sanitizers to be omitted or incorrectly selected in certain composition patterns. When attacker-influenced values are bound to DOM attributes such as href, src, action, xlink:href, or data, arbitrary JavaScript can execute in the victim's browser context — making this a client-side cross-site scripting class bug in a widely deployed frontend framework.

Technical Analysis

The vulnerability resides in how Angular's compiler and runtime determine which sanitizer — if any — to apply to a security-sensitive host binding. In Angular, DOM property and attribute bindings that map to dangerous sinks are meant to be routed through the built-in DomSanitizer, with a SecurityContext (for example URL, HTML, SCRIPT, or STYLE) determining the correct sanitization strategy. CVE-2026-88057 arises because the framework resolved that SecurityContext from the declaring directive or component selector rather than from the concrete host element on which the binding ultimately lands.

This mismatch allows scenarios where the sanitizer is either omitted entirely or chosen incorrectly. Per the NVD description, the mismatch is reachable through several concrete Angular features:

• hostDirectives composition — when directives are composed onto a host via the hostDirectives mechanism, the security context may be derived from the composed directive's metadata rather than the actual rendered host element.
• Inherited HostBinding declarations — bindings inherited through class hierarchies can be evaluated against the wrong selector context.
• createComponent with a custom hostElement or dynamic directives — programmatic component creation allows the host element to diverge from what the declaring selector implies.
• SVG/MathML namespace elements — these namespaces use different attribute semantics (e.g., xlink:href) than HTML, complicating context derivation.
• Tag-neutral selectors such as :not(...) — selectors that do not constrain the element tag make it impossible to infer the correct namespace or sink type from the selector alone.

Because the context is wrong, a malicious value supplied to a security-sensitive attribute (such as href, src, action, xlink:href, or data) can reach the DOM unsanitized. Depending on the attribute and namespace, this transitions directly into script execution — for example, a javascript: URL or event-handler-bearing value surviving into a live DOM attribute. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting) manifested through a framework-level sanitizer selection defect rather than a single application bug.

The root cause is not a missing sanitizer API but an incorrect binding of context to the sanitizer pipeline. Angular's design assumes the declaring selector is a reliable proxy for the host element's security surface; this assumption breaks under composition, inheritance, dynamic creation, namespace variation, and tag-neutral selectors. The attack surface is therefore any Angular application that (a) uses these patterns and (b) passes attacker-influenced data into security-sensitive host bindings.

Exploitation Scenarios

This section describes the attack chain at the vulnerability-class level, inferred from the NVD description. No public PoC is available; the steps below reflect the XSS vulnerability class and the specific mechanisms named in the advisory, not a tested exploit.

1. Reconnaissance / Target Identification. An attacker identifies a target web application built on a vulnerable Angular version (@angular/core or @angular/compiler < 20.3.28 / < 21.2.20 / < 22.1.0). Angular applications are fingerprintable via framework markers in rendered HTML and JavaScript bundles. The attacker then looks for application surfaces where user-controlled input flows into Angular directive host bindings — particularly components using hostDirectives, inherited HostBinding declarations, dynamically created components (createComponent with a custom hostElement), or SVG/MathML rendering paths.

2. Triggering the Specific Flaw. The attacker supplies input that is bound to a security-sensitive attribute (href, src, action, xlink:href, or data) on an element whose host binding is processed through one of the mismatched paths (composition, inheritance, dynamic host, namespace element, or tag-neutral selector). Because Angular derives SecurityContext from the declaring selector rather than the concrete host element, the sanitizer is omitted or mis-selected. The malicious input therefore reaches the DOM attribute without Angular's built-in sanitizer stripping or neutralizing it.

3. Payload / Execution Method (class-level). At the vulnerability-class level, the payload is a malicious value engineered to execute script when placed into the affected attribute — for example, a URL-scheme-based script payload delivered through href/src/xlink:href, or a value delivered through action/data that causes script execution in the victim's browser context when the resulting DOM is activated. The exact payload syntax depends on which attribute and namespace the vulnerable binding targets; the advisory confirms only that href, src, action, xlink:href, and data are the reachable sinks.

4. Post-Exploitation Impact. Successful execution grants arbitrary JavaScript execution in the user's browser context (reflected or stored XSS, depending on how input reaches the binding). This enables session/cookie theft where tokens are reachable to script, authenticated actions performed as the victim, credential phishing rendered within the trusted origin, and further pivoting within the application domain. The CVSS vector reflects network attack vector, high attack complexity (requires specific composition patterns), required user interaction, and changed scope (execution escapes the intended sanitization boundary), with high confidentiality impact.

Impact Assessment

The primary impact is client-side arbitrary JavaScript execution (XSS) in the context of applications using vulnerable Angular versions. Referencing the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N:

• AV:N (Network) — Exploitable remotely over the web; no local access required.
• AC:H (High) — Exploitation demands specific conditions: the application must use affected patterns (hostDirectives composition, inherited HostBinding, dynamic createComponent host elements, SVG/MathML elements, or tag-neutral selectors) and route attacker-influenced data into security-sensitive bindings.
• PR:N (None) — No privileges required on the application.
• UI:R (Required) — A victim must load or interact with the malicious content for execution to occur.
• S:C (Changed) — Scope changes: the flaw bypasses the intended sanitization boundary, so impact extends beyond the vulnerable component's security context.
• C:H (High) — Full compromise of data reachable to script in the victim's browser context (tokens, session data, rendered DOM).
• I:L (Low) — Limited integrity impact; attacker can perform some actions as the victim.
• A:N (None) — No availability impact.

Blast radius: Any Angular application on the affected version ranges that uses the named composition/dynamic patterns and exposes user-influenced input to host bindings. Because Angular is a broadly deployed framework, downstream impact depends on individual applications' use of these features. No EPSS score has been assigned by FIRST.org, and no CISA KEV listing is present, indicating no confirmed widespread exploitation at time of writing. However, the sanitizer-bypass nature and the framework's ubiquity make this a high-priority hardening item for affected codebases.

Detection Guidance

Detection focuses on the client-side nature of the flaw: exploitation manifests as malicious values reaching security-sensitive DOM attributes. Because there is no server-side exploit signature, detection combines runtime DOM monitoring, HTTP request inspection for script-payload-bearing parameters, and dependency/version auditing.

Sigma Rule

title: Angular Sanitizer Bypass - Suspicious Security-Sensitive Attribute Values
id: 8f2c1a90-3b7e-4d21-9c55-angularcve88057
status: experimental
description: Detects HTTP request parameters containing URL-scheme script payloads that may target Angular host binding sanitizer bypass (CVE-2026-88057)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88057
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_payload:
    - cs-uri-query|contains:
        - 'javascript:'
        - 'data:text/html'
        - 'vbscript:'
        - 'xlink:href='
        - 'href=javascript'
        - 'src=javascript'
  condition: selection_method and selection_payload
falsepositives:
  - Legitimate applications embedding trusted data URIs
  - Security scanners and fuzzers
level: medium
tags:
  - attack.t1189
  - cve.2026-88057
  - cwe.79

YARA Rule

rule CVE_2026_88057_Angular_Sanitizer_Bypass
{
    meta:
        description = "Detects JavaScript artifacts referencing Angular host binding sanitizer bypass patterns (CVE-2026-88057)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88057"
        date = "2026-01-01"
        cve = "CVE-2026-88057"

    strings:
        $ng1 = "@angular/core" ascii nocase
        $ng2 = "@angular/compiler" ascii nocase
        $bd1 = "hostDirectives" ascii
        $bd2 = "HostBinding" ascii
        $bd3 = "createComponent" ascii
        $bd4 = "hostElement" ascii
        $bd5 = "SecurityContext" ascii
        $sink1 = "xlink:href" ascii
        $sink2 = "javascript:" ascii

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true
        and ( $ng1 or $ng2 )
        and ( $bd1 or $bd2 or $bd3 or $bd4 or $bd5 )
        and ( $sink1 or $sink2 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88057 Angular Host Binding Sanitizer Bypass Attempt (script scheme in URL parameter)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"javascript:"; nocase; reference:cve,2026-88057; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88057; classtype:web-application-attack; sid:8805701; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method in ("GET","POST") and
      wildcard(http.request.uri.query, "*javascript:*") ]
  [ network where http.request.method in ("GET","POST") and
      wildcard(http.request.uri.query, "*xlink:href=*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval q=lower(cs_uri_query)
| where match(q,"(javascript:|data:text/html|vbscript:|xlink:href=)")
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_uri) as uris by src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,angular,cve-2026-88057,">
  <rule id="880570" level="10" frequency="3" timeframe="120">
    <if_matched_sid>31100</if_matched_sid>
    <match>javascript:|data:text/html|vbscript:|xlink:href=</match>
    <description>CVE-2026-88057: Possible Angular host binding sanitizer bypass - script scheme payload detected in HTTP request</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_88057,xss_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the NVD description states the issue is fixed in specific versions, but no patch metadata is available from tracked sources; verify fixes against official Angular release channels before relying on them.

1. Immediate mitigations (per the advisory):

   • Applications unable to upgrade can call DomSanitizer.sanitize with SecurityContext.URL on values before they are assigned to security-sensitive bindings.
   • Restrict inputs to validated HTTP and HTTPS URL schemes (reject javascript:, data:, and other non-HTTP(S) schemes).
   • Audit use of hostDirectives composition, inherited HostBinding declarations, createComponent with custom hostElement or dynamic directives, SVG/MathML elements, and tag-neutral selectors such as :not(...) — these are the reachable conditions.

2. Patch / upgrade steps:

   • Upgrade @angular/core and @angular/compiler to versions 20.3.28, 21.2.20, or 22.1.0 (whichever is appropriate for the maintained release line).
   • Because no CNA/vendor advisory URL was supplied in the intelligence data, obtain the authoritative fix from the official Angular project channels and verify the exact fixed version in package.json and lockfiles.
   • Re-run dependency audits (npm audit) after upgrade and confirm no transitive copies of @angular/core or @angular/compiler remain on vulnerable versions.

3. Long-term hardening:

   • Adopt a Content Security Policy that restricts script execution and blocks inline/script-scheme URL payloads where feasible.
   • Track Angular version currency as part of routine dependency management; subscribe to Angular security announcements.
   • Review application code that routes untrusted input into host bindings and treat any security-sensitive binding as untrusted by default.
   • Add automated SAST/regex checks (as in the detection rules above) for hostDirectives, HostBinding, createComponent with custom host elements, and SVG/MathML rendering paths.

References

• NVD — CVE-2026-88057: https://nvd.nist.gov/vuln/detail/CVE-2026-88057
• Angular project (official security/advisory channel): https://angular.dev
• CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1189 (Drive-by Compromise): https://attack.mitre.org/techniques/T1189/
• FIRST.org EPSS: https://www.first.org/epss (no score currently assigned for CVE-2026-88057)

Exploit-in-the-wild / threat actor note: No public PoC, exploit code, or Nuclei template is available, and the CVE is not listed in CISA KEV. No confirmed threat actor campaigns are associated with this CVE at time of writing. Detection guidance above targets the vulnerability class and the specific sinks named in the advisory; it is not derived from observed in-the-wild activity.