CVE-2026-50557

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50557", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-04T21:34:34.426Z", "datePublished": "2026-06-22T15:11:48.347Z", "dateUpdated": "2026-06-22T17:54:55.320Z"}, "containers": {"cna": {"title": "Angular: Template and Attribute Namespace Sanitization Bypass (XSS)", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x"}, {"name": "https://github.com/angular/angular/pull/68689", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/pull/68689"}, {"name": "https://github.com/angular/angular/pull/68868", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/pull/68868"}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"version": ">= 21.0.0-next.0 < 21.2.15", "status": "affected"}, {"version": ">= 22.0.0-next.0 < 22.0.0-rc.2", "status": "affected"}, {"version": ">= 20.0.0-next.0 < 20.3.22", "status": "affected"}, {"version": ">= 19.0.0-next.0 < 19.2.22", "status": "affected"}, {"version": "<= 18.2.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-22T15:11:48.347Z"}, "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22."}], "source": {"advisory": "GHSA-f3m7-gqxr-g87x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T17:51:06.519025Z", "id": "CVE-2026-50557", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T17:54:55.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50557", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T17:51:06.519025Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T17:54:48.607Z"}}], "cna": {"title": "Angular: Template and Attribute Namespace Sanitization Bypass (XSS)", "source": {"advisory": "GHSA-f3m7-gqxr-g87x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"status": "affected", "version": ">= 21.0.0-next.0 < 21.2.15"}, {"status": "affected", "version": ">= 22.0.0-next.0 < 22.0.0-rc.2"}, {"status": "affected", "version": ">= 20.0.0-next.0 < 20.3.22"}, {"status": "affected", "version": ">= 19.0.0-next.0 < 19.2.22"}, {"status": "affected", "version": "<= 18.2.14"}]}], "references": [{"url": "https://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x", "name": "https://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/angular/angular/pull/68689", "name": "https://github.com/angular/angular/pull/68689", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/pull/68868", "name": "https://github.com/angular/angular/pull/68868", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-22T15:11:48.347Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50557", "state": "PUBLISHED", "dateUpdated": "2026-06-22T17:54:55.320Z", "dateReserved": "2026-06-04T21:34:34.426Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-22T15:11:48.347Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "angular", "vendor": "angular", "versions": [{"status": "affected", "version": ">= 21.0.0-next.0 < 21.2.15"}, {"status": "affected", "version": ">= 22.0.0-next.0 < 22.0.0-rc.2"}, {"status": "affected", "version": ">= 20.0.0-next.0 < 20.3.22"}, {"status": "affected", "version": ">= 19.0.0-next.0 < 19.2.22"}, {"status": "affected", "version": "<= 18.2.14"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "B0857B9D-DDD4-42CC-B026-AF3B4081BD14", "versionEndIncluding": "18.2.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1600564B-1893-478C-8C8F-11283A716D16", "versionEndExcluding": "19.2.22", "versionStartIncluding": "19.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "6594675A-6A09-4550-AF8B-C9E25CCFE022", "versionEndExcluding": "20.3.22", "versionStartIncluding": "20.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "C446A761-4FD9-43B8-8EF2-8A23EC2091DF", "versionEndExcluding": "21.2.15", "versionStartIncluding": "21.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:*", "matchCriteriaId": "71DA6BB7-D67B-431B-A4BB-792DEC51C980", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:*", "matchCriteriaId": "01F108F8-1BC4-4E33-BB49-646C118CA697", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:*", "matchCriteriaId": "C5388FC5-DA5B-4C27-B868-E0D8BAD2EB28", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:*", "matchCriteriaId": "4A18EA1D-24C0-43F7-B73B-562F86E3A46E", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:*", "matchCriteriaId": "B59DAA7F-A7B5-4687-96B0-10CD61165910", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:*", "matchCriteriaId": "19366888-B58B-4AEE-B99C-CBB26CCF9AA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:*", "matchCriteriaId": "D22F98A2-DB7A-41D2-AAA0-90D8AE707267", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:*", "matchCriteriaId": "7D19C89E-9D61-4DBD-8CA5-5F317691E1B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:*", "matchCriteriaId": "D6E69821-B1AB-4FE8-9245-74775E86D346", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:*", "matchCriteriaId": "E7096357-4623-475F-A015-ADB8EE2B450F", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:*", "matchCriteriaId": "A81F04C2-2824-40B9-B7F8-B27E6DF21403", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:*", "matchCriteriaId": "D0002A01-F19D-47F3-94EA-C3423EC763E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:*", "matchCriteriaId": "7499CFC4-AAA5-461E-909F-0E514CFD5DA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:*", "matchCriteriaId": "2A781EF8-8ADA-4960-B839-0064607D36AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:*", "matchCriteriaId": "4775F816-6599-44D3-BD0F-9C843AB37DF3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22."}], "id": "CVE-2026-50557", "lastModified": "2026-07-09T15:40:45.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50557", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T17:51:06.519025Z", "version": "2.0.3"}}]}, "published": "2026-06-22T16:16:38.050", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/angular/angular/pull/68689"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/angular/angular/pull/68868"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@angular/compiler: @angular/core: Angular: Template and Attribute Namespace Sanitization Bypass (XSS)", "id": "2491419", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491419"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22.", "A flaw was found in Angular's @angular/compiler and @angular/core packages. Namespaced script elements were not properly identified by the template preparser, and security context schema mappings did not consistently handle attributes within namespaced elements. An attacker who can inject template structures with custom namespaces can bypass Angular's sanitization logic, potentially leading to cross-site scripting (XSS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-50557", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "core", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Fix deferred", "package_name": "compiler", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mozjs60", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "angular", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "qpid-dispatch", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Not affected", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Not affected", "package_name": "quay/quay-rhel9", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "angular", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-06-22T15:11:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50557\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50557\nhttps://github.com/angular/angular/pull/68689\nhttps://github.com/angular/angular/pull/68868\nhttps://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x"], "statement": "A flaw was found in Angular's @angular/compiler and @angular/core packages. Namespaced script elements (e.g., &lt;svg:script&gt;) were not properly identified as script elements by the Angular template preparser, and security context schema mappings did not consistently handle attributes within namespaced elements. This allows an attacker who can inject template structures to bypass Angular's sanitization logic, potentially leading to cross-site scripting (XSS). This vulnerability only affects Angular 2+ (versions 19.x through 22.x); AngularJS 1.x is a different codebase and is not affected. Red Hat products shipping AngularJS 1.x (such as firefox, grafana, and thunderbird) are not impacted by this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0-next.0,21.2.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0-next.0,22.0.0-rc.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0-next.0,20.3.22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.0.0-next.0,19.2.22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,18.2.14]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "angular", "source": "cna", "vendor": "angular"}, "product": "angular", "vendor": "angular"}], "created": "2026-06-22T17:00:06.227568+00:00", "updated": "2026-06-22T17:45:05.264913+00:00", "vendors": ["angular", "angular$PRODUCT$angular"]}