Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 47.3%
CVSS Severity
CVSS v3 Score 9.1
Products affected by CVE-2026-88056
  • Angular » Angular » Version: 22.0.0
    cpe:2.3:a:angular:angular:22.0.0
  • Angular » Angular » Version: 22.0.1
    cpe:2.3:a:angular:angular:22.0.1
  • Angular » Angular » Version: 22.0.2
    cpe:2.3:a:angular:angular:22.0.2
  • Angular » Angular » Version: 22.0.3
    cpe:2.3:a:angular:angular:22.0.3
  • Angular » Angular » Version: 22.0.4
    cpe:2.3:a:angular:angular:22.0.4
  • Angular » Angular » Version: 22.0.5
    cpe:2.3:a:angular:angular:22.0.5
  • Angular » Angular » Version: 22.0.6
    cpe:2.3:a:angular:angular:22.0.6
  • Angular » Angular » Version: 22.0.7
    cpe:2.3:a:angular:angular:22.0.7
  • Angular » Angular » Version: 22.0.8
    cpe:2.3:a:angular:angular:22.0.8
  • Angular » Angular » Version: 22.1.0
    cpe:2.3:a:angular:angular:22.1.0
  • Angular » Angular » Version: 22.1.1
    cpe:2.3:a:angular:angular:22.1.1
  • Angular » Angular » Version: 22.1.2
    cpe:2.3:a:angular:angular:22.1.2


Products
Pricing
Contact Us

Shodan ® - All rights reserved