EUVD-2026-39080
GHSA-7x27-g8rg-x87w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Network-reachable, low-complexity, unauthenticated bypass but the victim must load an affected page (UI:R); arbitrary in-session script yields high confidentiality with limited integrity/availability impact.
Primary rating from Vendor (36c7be3b-2937-45df-85ea-ca7133ea542c).
CVSS VectorVendor: 36c7be3b-2937-45df-85ea-ca7133ea542c
Lifecycle Timeline
1DescriptionCVE.org
A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.
SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.
This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.
Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .
AnalysisAI
Arbitrary JavaScript execution in AngularJS (all versions from 1.2.0-rc.3 onward) arises from a flaw in Strict Contextual Escaping (SCE) where resource-URL allowlist regular expressions are matched against URLs as partial rather than whole-string matches, letting attacker-controlled values slip past trusted-URL policies. A successful bypass runs script in the victim's browser session (script src, iframe documents, route templates), enabling client-side compromise; the framework is End-of-Life with no upstream fix, and a CodePen demonstration of the bypass is publicly available. No CISA KEV listing and no evidence of active exploitation were provided.
Technical ContextAI
AngularJS' SCE subsystem ($sce) is the framework's defense for security-sensitive contexts, gating values used as resource URLs - including <script> src, ng-include/route templates, and <iframe> document sources - through a trusted-URL allowlist (resourceUrlWhitelist) that developers commonly express with regular expressions. The vulnerability, classed as CWE-791 (incomplete filtering of special elements), stems from the matcher comparing a candidate URL against these regex patterns without anchoring to the full string, so a regex intended to match an entire trusted origin instead matches only a substring. An attacker can therefore craft a URL whose trusted-looking fragment satisfies the pattern while the operative portion points to attacker-controlled script, defeating the very allowlist meant to enforce trust. The flaw is in AngularJS core (the 1.x line, ubiquitous in legacy single-page apps), affecting every release at or above 1.2.0-rc.3.
RemediationAI
No vendor-released patch has been identified at time of analysis - AngularJS is End-of-Life and will receive no upstream fix - so the strategic remediation is migration off AngularJS to a supported framework, or adoption of a commercial extended-support/backported build such as HeroDevs Never-Ending Support (see https://www.herodevs.com/vulnerability-directory/cve-2026-11998). As compensating controls until then: audit every use of $sce.trustAsResourceUrl and resourceUrlWhitelist/resourceUrlBlacklist and replace permissive regex entries with exact-string or fully anchored ('^...$') patterns that cannot partial-match, since the bug is incomplete anchoring (this is the most direct mitigation but requires reviewing all allowlist definitions). Additionally, deploy a strict Content-Security-Policy that constrains script-src/frame-src/default-src to known origins to limit the impact of a bypass (trade-off: may break inline or third-party resources and requires testing), and avoid feeding untrusted/user-controlled input into resource-URL sinks (ng-include, route template URLs, iframe src). Cite the HeroDevs advisory above when tracking this internally.
Same weakness CWE-791 – Incomplete Filtering of Special Elements
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today