{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"1.2.0-rc.3","last_affected":"1.8.3"}],"component":"angular","cve_ids":["CVE-2026-11998"],"ecosystem":"npm","epss":0.00395,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7x27-g8rg-x87w","id":"tcs_01M5KFB4TKF6F8B18W95QB7VQ7","modified_at":"2026-07-17T22:11:38.961033Z","published_at":"2026-06-24T21:30:44Z","references":["https://osv.dev/vulnerability/GHSA-7x27-g8rg-x87w","https://nvd.nist.gov/vuln/detail/CVE-2026-11998","https://access.redhat.com/security/cve/CVE-2026-11998","https://bugzilla.redhat.com/show_bug.cgi?id=2492579","https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8","https://github.com/angular/angular.js","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json","https://www.herodevs.com/vulnerability-directory/cve-2026-11998","https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-7x27-g8rg-x87w","url":"https://osv.dev/vulnerability/GHSA-7x27-g8rg-x87w"}],"summary":"Angular's deprecated package has a Cross-Site Scripting issue"}