AngularJS CVE-2026-11998

Exploitation requires that the target AngularJS application (>= 1.2.0-rc.3) define its SCE resource-URL allowlist (resourceUrlWhitelist) using regular-expression matchers that are not fully anchored, AND that attacker-influenced data reach a resource-URL sink such as ng-include, a route/template URL, <script> src, or <iframe> document source. The CVSS UI:R requirement means the victim must load or interact with the affected page, so it is not a zero-click remote attack. Limiting factors: apps that use only exact-string allowlist entries, that never pass untrusted input into resource-URL contexts, or that enforce a strict CSP are substantially less exposed; no authentication is required of the attacker (PR:N), but the specific vulnerable regex configuration is the gating prerequisite.

The signals are mixed-but-meaningful. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L, 7.6 High) describes a network-reachable, low-complexity, unauthenticated bypass that nonetheless requires user interaction (UI:R) - the victim must load an affected page where attacker-influenced data flows into a resource-URL sink, which is a real limiting factor and means this is not a wormable, fully automatable flaw. No EPSS score, no CISA KEV entry, and no SSVC decision data were supplied, so exploitation probability cannot be quantified from the input; treat the absence of KEV as 'no public exploit identified as actively exploited' rather than proof of safety. A working CodePen proof-of-concept from the reporting vendor (HeroDevs) demonstrates the bypass, raising practical risk above a purely theoretical issue. The dominant real-world risk driver is not raw CVSS but the End-of-Life status: because AngularJS will never be patched upstream, any remaining deployment carries permanent exposure. Net: a genuine, moderate-to-high priority for organizations still running AngularJS, gated mainly by whether an app passes untrusted data into SCE-protected resource-URL contexts.

An attacker identifies an AngularJS app whose SCE resource-URL allowlist uses an unanchored regular expression, then crafts a URL containing a trusted-looking substring that satisfies the partial match while the effective target loads attacker script. When a victim visits a page (or follows a link) that renders the attacker-influenced URL into a script src, iframe, or template context, the script executes in the victim's session - exfiltrating session data or acting as the user. A CodePen proof-of-concept demonstrating the SCE bypass is publicly available.