CVE-2026-11998

Name	CVE-2026-11998
Description	A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs. This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3. Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1141314

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
angular.js (PTS)	bullseye	1.8.2-2	vulnerable
	bullseye (security)	1.8.3-1+deb12u1~deb11u1	vulnerable
	bookworm	1.8.3-1+deb12u1	vulnerable
	forky, sid, trixie	1.8.3-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
angular.js	source	(unstable)	(unfixed)			1141314

Notes

[trixie] - angular.js <no-dsa> (Minor issue)
[bookworm] - angular.js <postponed> (Minor issue; EOL upstream, no fix available; only reachable with custom RegExp trustedResourceUrlList matchers using alternation)
[bullseye] - angular.js <postponed> (Minor issue; EOL upstream, no fix available; only reachable with custom RegExp trustedResourceUrlList matchers using alternation)
https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs