VDB
CVE-2026-88057
CVE-2026-88057
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
EPSS 0.37% · 31.1th percentile
Risk Scores
CVSS 4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS Score
0.37%
31.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | kubeflow-katib | 0 |
| angular | compiler | 22.0.0, 0, 20.0.0 |
| angular | core | 22.0.0, 0, 20.0.0 |
| angular | angular | >= 22.0.0, < 22.1.0, <= 19.2.25, >= 20.0.0, < 20.3.28 |
| chainguard | kubeflow-katib | 0 |
Timeline
- Sep 10, 2026 CVE Published
- Sep 10, 2026 Coalition ESS Score
- Sep 11, 2026 EPSS Score
- Sep 15, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 3, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-88057 advisory
- https://github.com/advisories/GHSA-hh8m-fm6v-7cvg advisory
- https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg url
- https://github.com/angular/angular/issues/69550 url
- https://github.com/angular/angular/pull/69558 patch
- https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264 patch
- https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee patch
- https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b patch
- https://github.com/angular/angular/releases/tag/v20.3.28 url
- https://github.com/angular/angular/releases/tag/v21.2.20 url
- https://github.com/angular/angular/releases/tag/v22.1.0 url