EUVD-2026-39080
GHSA-7x27-g8rg-x87w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Network-reachable, low-complexity, unauthenticated bypass but the victim must load an affected page (UI:R); arbitrary in-session script yields high confidentiality with limited integrity/availability impact.
Primary rating from Vendor (36c7be3b-2937-45df-85ea-ca7133ea542c).
CVSS VectorVendor: 36c7be3b-2937-45df-85ea-ca7133ea542c
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.
SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.
This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.
Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .
AnalysisAI
Arbitrary JavaScript execution in AngularJS (all versions from 1.2.0-rc.3 onward) arises from a flaw in Strict Contextual Escaping (SCE) where resource-URL allowlist regular expressions are matched against URLs as partial rather than whole-string matches, letting attacker-controlled values slip past trusted-URL policies. A successful bypass runs script in the victim's browser session (script src, iframe documents, route templates), enabling client-side compromise; the framework is End-of-Life with no upstream fix, and a CodePen demonstration of the bypass is publicly available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target AngularJS application (>= 1.2.0-rc.3) define its SCE resource-URL allowlist (resourceUrlWhitelist) using regular-expression matchers that are not fully anchored, AND that attacker-influenced data reach a resource-URL sink such as ng-include, a route/template URL, <script> src, or <iframe> document source. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed-but-meaningful. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an AngularJS app whose SCE resource-URL allowlist uses an unanchored regular expression, then crafts a URL containing a trusted-looking substring that satisfies the partial match while the effective target loads attacker script. When a victim visits a page (or follows a link) that renders the attacker-influenced URL into a script src, iframe, or template context, the script executes in the victim's session - exfiltrating session data or acting as the user. … |
| Remediation | No vendor-released patch has been identified at time of analysis - AngularJS is End-of-Life and will receive no upstream fix - so the strategic remediation is migration off AngularJS to a supported framework, or adoption of a commercial extended-support/backported build such as HeroDevs Never-Ending Support (see https://www.herodevs.com/vulnerability-directory/cve-2026-11998). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Complete inventory of AngularJS deployments across internal applications and third-party dependencies; document user count and data classification for each application. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-791 – Incomplete Filtering of Special Elements
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today