CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities called String.prototype.trim(), which removed leading Unicode whitespace such as U+00A0 or U+FEFF after the input passed a same-origin check, converting a relative path into a protocol-relative attacker-controlled URL. In affected applications that attach sensitive server-side credentials such as Authorization headers to approved requests, relativeUrlsTransformerInterceptorFn then dispatched the request to the attacker-controlled origin, causing SSRF and credential disclosure. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

• CWE-918

• https://github.com/angular/angular/commit/3e924cc8dbbb57f23b262cb8f0d7e2bd0673034cPatch
• https://github.com/angular/angular/commit/5aa6d97deb9ef1de14e23748b7fa74f97d183132Patch
• https://github.com/angular/angular/commit/71e52d1396b9cef98652929b73e08c4cde645970Patch
• https://github.com/angular/angular/releases/tag/v20.3.30Release Notes
• https://github.com/angular/angular/releases/tag/v21.2.22Release Notes
• https://github.com/angular/angular/releases/tag/v22.1.4Release Notes
• https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4Exploit, Mitigation, Vendor Advisory
• https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4Exploit, Mitigation, Vendor Advisory

Published

Sep 10, 2026

Last Modified

Sep 29, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88050Tesseract is an open source OCR engine. In version 5.5.3 and…5.5
• CVE-2026-88051Tesseract is an open source OCR engine. In version 5.5.3 and…7.8
• CVE-2026-88052Tesseract is an open source OCR engine. In version 5.5.3 and…7.8
• CVE-2026-88053Tesseract is an open source OCR engine. In version 5.5.3 and…7.8
• CVE-2026-88054Tesseract is an open source OCR engine. In version 5.5.3 and…5.5
• CVE-2026-88055AnythingLLM is an application that turns pieces of content i…5.5
• CVE-2026-88057Angular is a development platform for building mobile and de…6.1
• CVE-2026-88058Angular is a development platform for building mobile and de…6.1
• CVE-2026-88059Angular is a development platform for building mobile and de…5.8
• CVE-2026-8806Expected Behavior Violation vulnerability in Mitsubishi Elec…8.7
• CVE-2026-88060Angular is a development platform for building mobile and de…6.1
• CVE-2026-88061career-ops is an open-source AI-assisted job search and appl…5.8