Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-11998

7.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 1 month ago by @LeSuisse Activity log

Created suggestion 1 month ago
@LeSuisse dismissed (not in Nixpkgs) 1 month ago

AngularJS XSS via SCE resource URL sanitization bypass

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs. This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3. Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .

References

https://www.herodevs.com/vulnerability-directory/cve-2026-11998 third-party-advisory
https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8 technical-descriptionexploit

Affected products

angular

==>=1.2.0-rc.3

Matching in nixpkgs

pkgs.angular-language-server

LSP for angular completions, AOT diagnostic, quick info and go to definitions

nixos-unstable 21.2.2
- nixpkgs-unstable 21.2.2
- nixos-unstable-small 21.2.2
nixos-26.05 21.2.2
- nixos-26.05-small 21.2.2
- nixpkgs-26.05-darwin 21.2.2

pkgs.nodePackages.%40angular%2Fcli

None

pkgs.nodePackages_latest.%40angular%2Fcli

None

pkgs.vscode-extensions.angular.ng-template

Editor services for Angular templates

nixos-unstable 22.0.0
- nixpkgs-unstable 22.0.0
- nixos-unstable-small 22.0.0
nixos-26.05 21.2.3
- nixos-26.05-small 21.2.3
- nixpkgs-26.05-darwin 21.2.3

pkgs.vimPlugins.nvim-treesitter-parsers.angular

Tree-sitter grammar for angular

nixos-unstable 0.0.0+rev=f0d0685
- nixpkgs-unstable 0.0.0+rev=f0d0685
- nixos-unstable-small 0.0.0+rev=f0d0685
nixos-26.05 0.0.0+rev=f0d0685
- nixos-26.05-small 0.0.0+rev=f0d0685
- nixpkgs-26.05-darwin 0.0.0+rev=f0d0685

Package maintainers

@tricktron Thibault Gagnaux <tgagnaux@gmail.com>
@ratsclub Victor Freire <victor@freire.dev.br>

Not directly packaged, control is under upstream lockfile management

Untriaged

Permalink CVE-2026-41423

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 2 months, 2 weeks ago Activity log

Created suggestion 2 months, 2 weeks ago

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8.

References

https://github.com/angular/angular/security/advisories/GHSA-45q2-gjvg-7973 x_refsource_CONFIRM
https://github.com/angular/angular/pull/68194 x_refsource_MISC
https://github.com/angular/angular/commit/ede7c58a2aa13fdccc8f0b67ce93ba1c11749412 x_refsource_MISC

Affected products

angular

==>= 21.0.0-next.0, < 21.2.9
==>= 22.0.0-next.0, < 22.0.0-next.8
==< 19.2.21
==>= 20.0.0-next.0, < 20.3.19

Matching in nixpkgs

pkgs.angular-language-server

LSP for angular completions, AOT diagnostic, quick info and go to definitions

nixos-unstable 21.2.2
- nixpkgs-unstable 21.2.2
- nixos-unstable-small 21.2.2

nixos-unstable 21.2.3
- nixpkgs-unstable 21.2.3
- nixos-unstable-small 21.2.3

pkgs.vimPlugins.nvim-treesitter-parsers.angular

Tree-sitter grammar for angular

nixos-unstable 0.0.0+rev=f0d0685
- nixpkgs-unstable 0.0.0+rev=f0d0685
- nixos-unstable-small 0.0.0+rev=f0d0685

Package maintainers

@tricktron Thibault Gagnaux <tgagnaux@gmail.com>
@ratsclub Victor Freire <victor@freire.dev.br>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.angular-language-server

pkgs.nodePackages.%40angular%2Fcli

pkgs.nodePackages_latest.%40angular%2Fcli

pkgs.vscode-extensions.angular.ng-template

pkgs.vimPlugins.nvim-treesitter-parsers.angular

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.angular-language-server

pkgs.nodePackages.%40angular%2Fcli

pkgs.nodePackages_latest.%40angular%2Fcli

pkgs.vscode-extensions.angular.ng-template

pkgs.vimPlugins.nvim-treesitter-parsers.angular

Package maintainers