Skip to content

Commit 2e68d01

Browse files
eoftedalgithub-actions[bot]
eoftedal
and
github-actions[bot]
authored
Auto-update jsrepository: @angular/core | GHSA-hh8m-fm6v-7cvg (#621)
Updated libraries (1): @angular/core Updated vulnerability IDs (1): GHSA-hh8m-fm6v-7cvg Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 2a97226 commit 2e68d01

9 files changed

Lines changed: 883 additions & 0 deletions

‎repository/jsrepository-master.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3715,6 +3715,49 @@
37153715
"https://github.com/angular/angular/pull/69064",
37163716
"https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa"
37173717
]
3718+
},
3719+
{
3720+
"ranges": [
3721+
{
3722+
"atOrAbove": "22.0.0",
3723+
"below": "22.1.0"
3724+
},
3725+
{
3726+
"atOrAbove": "21.0.0",
3727+
"below": "21.2.20"
3728+
},
3729+
{
3730+
"atOrAbove": "20.0.0",
3731+
"below": "20.3.28"
3732+
},
3733+
{
3734+
"atOrAbove": "0",
3735+
"below": "19.2.26"
3736+
}
3737+
],
3738+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
3739+
"details": "Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as `href`, `src`, `action`, `xlink:href`, and `data`) to protect against Cross-Site Scripting (XSS).\n\nPrior to the fix, the Angular compiler determined the `SecurityContext` for directive host bindings (`host: {'[attr.href]': 'value'}` or `@HostBinding('attr.href')`) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.\n\nWhen a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:\n- `hostDirectives` composition,\n- Class inheritance of host bindings,\n- Dynamic component instantiation (`createComponent` with custom `hostElement` or dynamic directives),\n- Elements with SVG/MathML namespaces (e.g. `<svg:a>`, `<math>`), or\n- Elements using tag-neutral selectors (e.g. `:not(...)`),\n\nthe compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. `javascript:...` URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.\n\n### Impact\nAn attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).\n\n### Patches\nThis issue has been resolved in versions:\n- `22.1.0` \n- `21.2.20`\n- `20.3.28`\n\n### Workarounds\nEnsure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using `DomSanitizer.sanitize(SecurityContext.URL, ...)` before assignment, or restrict the input to validated safe URL schemes (e.g. `http://`, `https://`).",
3740+
"identifiers": {
3741+
"githubID": "GHSA-hh8m-fm6v-7cvg",
3742+
"CVE": [
3743+
"CVE-2026-88057"
3744+
]
3745+
},
3746+
"severity": "medium",
3747+
"cwe": [
3748+
"CWE-79"
3749+
],
3750+
"info": [
3751+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
3752+
"https://github.com/angular/angular/issues/69550",
3753+
"https://github.com/angular/angular/pull/69558",
3754+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
3755+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
3756+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
3757+
"https://github.com/angular/angular/releases/tag/v20.3.28",
3758+
"https://github.com/angular/angular/releases/tag/v21.2.20",
3759+
"https://github.com/angular/angular/releases/tag/v22.1.0"
3760+
]
37183761
}
37193762
],
37203763
"extractors": {

‎repository/jsrepository-v2.json‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3886,6 +3886,32 @@
38863886
"https://github.com/angular/angular/pull/68713"
38873887
]
38883888
},
3889+
{
3890+
"atOrAbove": "0",
3891+
"below": "19.2.26",
3892+
"severity": "medium",
3893+
"cwe": [
3894+
"CWE-79"
3895+
],
3896+
"identifiers": {
3897+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
3898+
"githubID": "GHSA-hh8m-fm6v-7cvg",
3899+
"CVE": [
3900+
"CVE-2026-88057"
3901+
]
3902+
},
3903+
"info": [
3904+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
3905+
"https://github.com/angular/angular/issues/69550",
3906+
"https://github.com/angular/angular/pull/69558",
3907+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
3908+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
3909+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
3910+
"https://github.com/angular/angular/releases/tag/v20.3.28",
3911+
"https://github.com/angular/angular/releases/tag/v21.2.20",
3912+
"https://github.com/angular/angular/releases/tag/v22.1.0"
3913+
]
3914+
},
38893915
{
38903916
"atOrAbove": "0",
38913917
"below": "19.2.26",
@@ -4018,6 +4044,32 @@
40184044
"https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa"
40194045
]
40204046
},
4047+
{
4048+
"atOrAbove": "20.0.0",
4049+
"below": "20.3.28",
4050+
"severity": "medium",
4051+
"cwe": [
4052+
"CWE-79"
4053+
],
4054+
"identifiers": {
4055+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
4056+
"githubID": "GHSA-hh8m-fm6v-7cvg",
4057+
"CVE": [
4058+
"CVE-2026-88057"
4059+
]
4060+
},
4061+
"info": [
4062+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
4063+
"https://github.com/angular/angular/issues/69550",
4064+
"https://github.com/angular/angular/pull/69558",
4065+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
4066+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
4067+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
4068+
"https://github.com/angular/angular/releases/tag/v20.3.28",
4069+
"https://github.com/angular/angular/releases/tag/v21.2.20",
4070+
"https://github.com/angular/angular/releases/tag/v22.1.0"
4071+
]
4072+
},
40214073
{
40224074
"atOrAbove": "21.0.0-next.0",
40234075
"below": "21.1.6",
@@ -4155,6 +4207,32 @@
41554207
"https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa"
41564208
]
41574209
},
4210+
{
4211+
"atOrAbove": "21.0.0",
4212+
"below": "21.2.20",
4213+
"severity": "medium",
4214+
"cwe": [
4215+
"CWE-79"
4216+
],
4217+
"identifiers": {
4218+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
4219+
"githubID": "GHSA-hh8m-fm6v-7cvg",
4220+
"CVE": [
4221+
"CVE-2026-88057"
4222+
]
4223+
},
4224+
"info": [
4225+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
4226+
"https://github.com/angular/angular/issues/69550",
4227+
"https://github.com/angular/angular/pull/69558",
4228+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
4229+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
4230+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
4231+
"https://github.com/angular/angular/releases/tag/v20.3.28",
4232+
"https://github.com/angular/angular/releases/tag/v21.2.20",
4233+
"https://github.com/angular/angular/releases/tag/v22.1.0"
4234+
]
4235+
},
41584236
{
41594237
"atOrAbove": "22.0.0-next.0",
41604238
"below": "22.0.0-rc.2",
@@ -4239,6 +4317,32 @@
42394317
"https://github.com/angular/angular/pull/69064",
42404318
"https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa"
42414319
]
4320+
},
4321+
{
4322+
"atOrAbove": "22.0.0",
4323+
"below": "22.1.0",
4324+
"severity": "medium",
4325+
"cwe": [
4326+
"CWE-79"
4327+
],
4328+
"identifiers": {
4329+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
4330+
"githubID": "GHSA-hh8m-fm6v-7cvg",
4331+
"CVE": [
4332+
"CVE-2026-88057"
4333+
]
4334+
},
4335+
"info": [
4336+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
4337+
"https://github.com/angular/angular/issues/69550",
4338+
"https://github.com/angular/angular/pull/69558",
4339+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
4340+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
4341+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
4342+
"https://github.com/angular/angular/releases/tag/v20.3.28",
4343+
"https://github.com/angular/angular/releases/tag/v21.2.20",
4344+
"https://github.com/angular/angular/releases/tag/v22.1.0"
4345+
]
42424346
}
42434347
],
42444348
"extractors": {

‎repository/jsrepository-v3.json‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3962,6 +3962,32 @@
39623962
"https://github.com/angular/angular/pull/68713"
39633963
]
39643964
},
3965+
{
3966+
"atOrAbove": "0",
3967+
"below": "19.2.26",
3968+
"severity": "medium",
3969+
"cwe": [
3970+
"CWE-79"
3971+
],
3972+
"identifiers": {
3973+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
3974+
"githubID": "GHSA-hh8m-fm6v-7cvg",
3975+
"CVE": [
3976+
"CVE-2026-88057"
3977+
]
3978+
},
3979+
"info": [
3980+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
3981+
"https://github.com/angular/angular/issues/69550",
3982+
"https://github.com/angular/angular/pull/69558",
3983+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
3984+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
3985+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
3986+
"https://github.com/angular/angular/releases/tag/v20.3.28",
3987+
"https://github.com/angular/angular/releases/tag/v21.2.20",
3988+
"https://github.com/angular/angular/releases/tag/v22.1.0"
3989+
]
3990+
},
39653991
{
39663992
"atOrAbove": "0",
39673993
"below": "19.2.26",
@@ -4094,6 +4120,32 @@
40944120
"https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa"
40954121
]
40964122
},
4123+
{
4124+
"atOrAbove": "20.0.0",
4125+
"below": "20.3.28",
4126+
"severity": "medium",
4127+
"cwe": [
4128+
"CWE-79"
4129+
],
4130+
"identifiers": {
4131+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
4132+
"githubID": "GHSA-hh8m-fm6v-7cvg",
4133+
"CVE": [
4134+
"CVE-2026-88057"
4135+
]
4136+
},
4137+
"info": [
4138+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
4139+
"https://github.com/angular/angular/issues/69550",
4140+
"https://github.com/angular/angular/pull/69558",
4141+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
4142+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
4143+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
4144+
"https://github.com/angular/angular/releases/tag/v20.3.28",
4145+
"https://github.com/angular/angular/releases/tag/v21.2.20",
4146+
"https://github.com/angular/angular/releases/tag/v22.1.0"
4147+
]
4148+
},
40974149
{
40984150
"atOrAbove": "21.0.0-next.0",
40994151
"below": "21.1.6",
@@ -4231,6 +4283,32 @@
42314283
"https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa"
42324284
]
42334285
},
4286+
{
4287+
"atOrAbove": "21.0.0",
4288+
"below": "21.2.20",
4289+
"severity": "medium",
4290+
"cwe": [
4291+
"CWE-79"
4292+
],
4293+
"identifiers": {
4294+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
4295+
"githubID": "GHSA-hh8m-fm6v-7cvg",
4296+
"CVE": [
4297+
"CVE-2026-88057"
4298+
]
4299+
},
4300+
"info": [
4301+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
4302+
"https://github.com/angular/angular/issues/69550",
4303+
"https://github.com/angular/angular/pull/69558",
4304+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
4305+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
4306+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
4307+
"https://github.com/angular/angular/releases/tag/v20.3.28",
4308+
"https://github.com/angular/angular/releases/tag/v21.2.20",
4309+
"https://github.com/angular/angular/releases/tag/v22.1.0"
4310+
]
4311+
},
42344312
{
42354313
"atOrAbove": "22.0.0-next.0",
42364314
"below": "22.0.0-rc.2",
@@ -4315,6 +4393,32 @@
43154393
"https://github.com/angular/angular/pull/69064",
43164394
"https://github.com/angular/angular/commit/6bde84fa8e6a5770b54040fbbc9bf10d5d0386fa"
43174395
]
4396+
},
4397+
{
4398+
"atOrAbove": "22.0.0",
4399+
"below": "22.1.0",
4400+
"severity": "medium",
4401+
"cwe": [
4402+
"CWE-79"
4403+
],
4404+
"identifiers": {
4405+
"summary": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
4406+
"githubID": "GHSA-hh8m-fm6v-7cvg",
4407+
"CVE": [
4408+
"CVE-2026-88057"
4409+
]
4410+
},
4411+
"info": [
4412+
"https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg",
4413+
"https://github.com/angular/angular/issues/69550",
4414+
"https://github.com/angular/angular/pull/69558",
4415+
"https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264",
4416+
"https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee",
4417+
"https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b",
4418+
"https://github.com/angular/angular/releases/tag/v20.3.28",
4419+
"https://github.com/angular/angular/releases/tag/v21.2.20",
4420+
"https://github.com/angular/angular/releases/tag/v22.1.0"
4421+
]
43184422
}
43194423
],
43204424
"extractors": {

0 commit comments

Comments
 (0)