SB2026091147 - Multiple vulnerabilities in Angular

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091147

SB2026091147 - Multiple vulnerabilities in Angular

Published: September 11, 2026

Security Bulletin ID SB2026091147
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2026-54264)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive credentials and session identifiers.

The vulnerability exists due to improper handling of cross-origin redirects in the Angular Service Worker asset-fetching functionality when fetching assets that are redirected to a different origin. A remote attacker can cause a cross-origin redirect to an untrusted origin to disclose sensitive credentials and session identifiers.

Exploitation requires asset-group requests to include sensitive headers or cookies.


2) Inefficient regular expression complexity (CVE-ID: CVE-2026-54268)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the formatDate function and Angular DatePipe when processing excessively long attacker-controlled date format strings. A remote attacker can supply a maliciously crafted date format string to cause a denial of service.

Exploitation requires the application to use formatDate or DatePipe with a date format string controlled by untrusted input.


3) Modification of assumed-immutable data (CVE-ID: CVE-2026-54267)

CWE-ID: CWE-471 - Modification of Assumed-Immutable Data

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to poison HTTP Transfer Cache responses.

The vulnerability exists due to improper control of assumed-immutable data in the Angular client hydration state-container lookup when processing attacker-controlled element IDs before the genuine state script is parsed. A remote attacker can inject a clobbered ng-state element containing forged JSON to poison HTTP Transfer Cache responses.

User interaction is required.


4) Reversible One-Way Hash (CVE-ID: CVE-2026-54266)

CWE-ID: CWE-328 - Use of Weak Hash

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and poison application state.

The vulnerability exists due to use of a weak hash in HttpTransferCache when generating TransferState cache keys for server-side rendered HTTP requests. A remote attacker can send a crafted link containing colliding query parameters to disclose sensitive information and poison application state.

Exploitation requires an SSR page that makes both a request containing the colliding parameter and a sensitive request.


5) Cross-site scripting (CVE-ID: CVE-2026-54265)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the target user\'s browser.

The vulnerability exists due to improper neutralization of input in the @angular/compiler TwoWayProperty operation when processing two-way bindings on sensitive native DOM properties. A remote attacker can supply an unsanitized user-controlled property value to execute arbitrary JavaScript in the target user\'s browser.

Exploitation requires a user to interact with content containing the injected value.


Remediation

Install update from vendor's website.

References