{"action":"Upgrade @angular/ssr to 20.3.36 or later.","affected":[{"fixed":"22.1.7","introduced":"22.0.0"},{"fixed":"21.2.23","introduced":"21.0.0"},{"fixed":"20.3.36","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.27"}],"component":"@angular/ssr","cve_ids":["CVE-2026-104871"],"ecosystem":"npm","epss":0.00421,"exploited":false,"fixed_versions":["22.1.7","21.2.23","20.3.36"],"ghsa_id":"GHSA-7g7c-h8rr-7p6q","id":"tcs_01M5KF9XM5JFZ0E5RBQTEB989Q","modified_at":"2026-10-05T23:00:04.245230888Z","published_at":"2026-10-05T22:53:45Z","references":["https://osv.dev/vulnerability/GHSA-7g7c-h8rr-7p6q","https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q","https://nvd.nist.gov/vuln/detail/CVE-2026-104871","https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2","https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755","https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841","https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914","https://github.com/angular/angular-cli","https://github.com/angular/angular-cli/releases/tag/v20.3.36","https://github.com/angular/angular-cli/releases/tag/v21.2.23","https://github.com/angular/angular-cli/releases/tag/v22.1.7"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-7g7c-h8rr-7p6q","url":"https://osv.dev/vulnerability/GHSA-7g7c-h8rr-7p6q"},{"source":"nvd","source_id":"CVE-2026-104871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104871"}],"summary":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows"}