CVE-2026-88057

A flaw was found in Angular's @angular/core and @angular/compiler components. This vulnerability allows a remote attacker to bypass security sanitization mechanisms. By injecting malicious data into specific HTML attributes, an attacker can cause the application to execute arbitrary JavaScript code in the user's browser, leading to a Cross-Site Scripting (XSS) attack. This occurs because the system incorrectly determines the security context for certain directive host bindings.

This vulnerability is rated Moderate because exploitation requires specific directive composition or dynamic instantiation patterns alongside user interaction to deliver crafted inputs into affected client-side attributes. In Red Hat products utilizing embedded Angular components or web user interfaces, the flaw could allow cross-site scripting if an attacker can manipulate host binding parameters within a victim's session. However, the attack does not compromise the underlying host system directly, and standard server-side session protections and browser security boundaries constrain the overall blast radius.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.