{"id":"CVE-2026-111754","revision":"92d2f648d5774f45993fd4e42b931042","records":[{"revision":"92d2f648d5774f45993fd4e42b931042","observedAt":"2026-11-03T22:57:17.07+00:00","statement":{"source":"cve-program","id":"CVE-2026-111754","aliases":[],"title":"Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","state":0,"publishedAt":"2026-11-03T20:55:11.497+00:00","modifiedAt":"2026-11-03T21:23:55.644+00:00","affected":[{"ecosystem":"Vendor product","name":"angular","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"angular\",\n                    \"product\": \"angular\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 19.2.25\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 20.0.0, < 20.3.33\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 21.0.0, < 21.2.25\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 22.0.0, < 22.2.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.1,"severity":"MEDIUM"}],"references":["https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3","https://github.com/angular/angular/issues/71076","https://github.com/angular/angular/pull/71077","https://github.com/angular/angular/pull/71078","https://github.com/angular/angular/pull/71079","https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a","https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262","https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111754","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111754","identifiers":["CVE-2026-111754"]},"retained":false,"historicalAffected":[]}],"coverage":[]}