CVE-2026-111754

Что произошло

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "<= 19.2.25"
}

{
  "status": "affected",
  "version": ">= 20.0.0, < 20.3.33"
}

{
  "status": "affected",
  "version": ">= 21.0.0, < 21.2.25"
}

{
  "status": "affected",
  "version": ">= 22.0.0, < 22.2.1"
}

{
  "status": "affected",
  "version": "*",
  "versionEndExcluding": "22.2.1",
  "versionStartIncluding": "22.0.0"
}

{
  "status": "affected",
  "version": "*",
  "versionEndExcluding": "21.2.25",
  "versionStartIncluding": "21.0.0"
}

{
  "status": "affected",
  "version": "*",
  "versionEndExcluding": "20.3.33",
  "versionStartIncluding": "20.0.0"
}

{
  "status": "affected",
  "version": "*",
  "versionEndIncluding": "19.2.25"
}

CVSS: оценки и векторы

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Источники и ссылки

{
  "cwes": [
    "cve",
    "nvd"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-04T21:14:23.310261+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-11-03T21:42:21.543583+00:00"
  },
  "scores": [
    "cve",
    "nvd"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-11-03T21:42:21.543583+00:00"
  },
  "affected": [
    "cve",
    "osv"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-11-03T21:42:21.543583+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-04T21:14:23.310261+00:00"
  },
  "references": [
    "cve",
    "nvd",
    "osv"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-11-03T21:42:21.543583+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены05.11.2026, 00:14
2. Данные обновлены04.11.2026, 00:46
3. Данные обновлены03.11.2026, 23:56
4. Опубликована02.11.2026, 15:16

Личная заметка и статус

Другие CVE того же продукта