CVE-2026-11998
1 advisory.
npm/angular CVE-2026-11998: high 7.6, EPSS 0.50%
Angular's deprecated package has a Cross-Site Scripting issue
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0-rc.3 | - | 1.8.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-7x27-g8rg-x87w
- https://nvd.nist.gov/vuln/detail/CVE-2026-11998
- https://access.redhat.com/security/cve/CVE-2026-11998
- https://bugzilla.redhat.com/show_bug.cgi?id=2492579
- https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8
- https://github.com/angular/angular.js
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json
- https://www.herodevs.com/vulnerability-directory/cve-2026-11998
- https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs
CVE-2026-11998 · published · modified · JSON