AngularJS Incomplete filtering of special elements Vulnerability (CVE-2026-11998) - Vulnerability Database

AngularJS Incomplete filtering of special elements Vulnerability (CVE-2026-11998)

Description

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs. This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3. Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .</p> </div> <div class="detail-section"> <h3>References</h3> <div class="references-container"> <div class="reference-item"> <div class="reference-content"> <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-11998" target="_blank" rel="noopener noreferrer nofollow" class="reference-link"> <span class="reference-icon"> <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path> <polyline points="15,3 21,3 21,9"></polyline> <line x1="10" y1="14" x2="21" y2="3"></line> </svg> </span> <span class="reference-text">CVE-2026-11998</span> </a> </div> </div> </div> </div> <div class="detail-section"> <h3>Related Vulnerabilities</h3> <div class="related-vulnerabilities"> <div class="related-vulnerability-item"> <div class="related-vulnerability-header"> <a href="/web-application-vulnerabilities/virtuemart-access-control-bypass" class="related-vulnerability-title"> VirtueMart access control bypass </a> <span class="severity-icon high-icon">High</span> </div> <div class="common-tags"> <span class="common-tags-label">Common tags:</span> <span class="common-tag">Missing Update</span> <span class="common-tag">Known Vulnerabilities</span> </div> </div> <div class="related-vulnerability-item"> <div class="related-vulnerability-header"> <a href="/web-application-vulnerabilities/vulnerable-javascript-libraries" class="related-vulnerability-title"> Vulnerable JavaScript libraries </a> <span class="severity-icon medium-icon">Medium</span> </div> <div class="common-tags"> <span class="common-tags-label">Common tags:</span> <span class="common-tag">Missing Update</span> <span class="common-tag">Known Vulnerabilities</span> </div> </div> <div class="related-vulnerability-item"> <div class="related-vulnerability-header"> <a href="/web-application-vulnerabilities/invision-power-board-version-3-3-4-unserialize-php-code-execution" class="related-vulnerability-title"> Invision Power Board version 3.3.4 unserialize PHP code execution </a> <span class="severity-icon high-icon">High</span> </div> <div class="common-tags"> <span class="common-tags-label">Common tags:</span> <span class="common-tag">Missing Update</span> <span class="common-tag">Known Vulnerabilities</span> </div> </div> <div class="related-vulnerability-item"> <div class="related-vulnerability-header"> <a href="/web-application-vulnerabilities/ibm-lotus-domino-web-server-cross-site-scripting-vulnerabilities" class="related-vulnerability-title"> IBM Lotus Domino web server Cross-Site Scripting vulnerabilities </a> <span class="severity-icon high-icon">High</span> </div> <div class="common-tags"> <span class="common-tags-label">Common tags:</span> <span class="common-tag">Missing Update</span> <span class="common-tag">Known Vulnerabilities</span> </div> </div> <div class="related-vulnerability-item"> <div class="related-vulnerability-header"> <a href="/web-application-vulnerabilities/vmware-directory-traversal-and-privilege-escalation-vulnerabilities" class="related-vulnerability-title"> VMware directory traversal and privilege escalation vulnerabilities </a> <span class="severity-icon high-icon">High</span> </div> <div class="common-tags"> <span class="common-tags-label">Common tags:</span> <span class="common-tag">Missing Update</span> <span class="common-tag">Known Vulnerabilities</span> </div> </div> </div> </div> </div>  <div class="right-column"> <div class="detail-section"> <h3>Severity</h3> <span class="severity-icon high-icon">High</span> </div> <div class="detail-section"> <h3>Classification</h3> <div class="classification-boxes"> <div class="classification-box cve-box"> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11998" target="_blank" rel="noopener noreferrer nofollow"> CVE-2026-11998 </a> </div> <div class="classification-box cvss-box"> <a href="https://www.first.org/cvss/calculator/3.0#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" target="_blank" rel="noopener noreferrer nofollow"> CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L </a> </div> </div> </div> <div class="detail-section"> <h3>Tags</h3> <div class="tags-container"> <div class="tag-box"> <a href="/web-application-vulnerabilities/tag/missing-update"> Missing Update </a> </div> <div class="tag-box"> <a href="/web-application-vulnerabilities/tag/known-vulnerabilities"> Known Vulnerabilities </a> </div> </div> </div> </div> </div> </div> </main> </div> </div>  <footer class="site-footer"> <div class="container"> <div class="footer-content"> <div class="footer-info"> <p>© 2026 Invicti Security. All rights reserved.</p> </div> <div class="footer-links"> <a href="https://www.invicti.com/legal/">Legal</a> <a href="https://www.invicti.com/compliance/california-privacy-rights/">California Privacy Rights</a> <a href="https://www.invicti.com/compliance/privacy-policy/">Privacy Policy</a> <a href="https://www.invicti.com/legal/terms/">Terms of Use</a> <a href="https://www.invicti.com/accessibility/">Accessibility</a> <a href="https://www.invicti.com/contact/">Contact</a> </div> </div> </div> </footer>  <script src="/web-application-vulnerabilities/js/vdb.js"></script> <script src="/web-application-vulnerabilities/js/fuse.min.js"></script> <script src="/web-application-vulnerabilities/js/search.js"></script>  <script> // Google Analytics or other tracking scripts </script>  <script>function hashString(str){let hash=0;for(let i=0;i<str.length;i++)hash=(hash<<5)-hash+str.charCodeAt(i),hash|=0;return hash}document.addEventListener("DOMContentLoaded",function(){var banner=document.querySelector(".banner");if(!banner)return;var bannerTextEl=banner.querySelector(".banner-text");if(!bannerTextEl)return;var currentContentHash=hashString(bannerTextEl.textContent.trim()),savedContentHash=localStorage.getItem("bannerContentHash");savedContentHash!==currentContentHash.toString()&&(localStorage.removeItem("bannerClosed"),localStorage.setItem("bannerContentHash",currentContentHash),document.documentElement.classList.remove("banner-closed"),banner.style.display=""),localStorage.getItem("bannerClosed")==="true"&&(document.documentElement.classList.add("banner-closed"),banner.style.display="none");var closeBtn=banner.querySelector(".x-icon");closeBtn&&closeBtn.addEventListener("click",function(){banner.style.display="none",localStorage.setItem("bannerClosed","true"),document.documentElement.classList.add("banner-closed")},{once:!0})});</script> </body> </html>