Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package mozjs60-devel  (opens in a new tab)

Threat Intelligence

EPSS
0.33% (26th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-MOZJS60DEVEL-17725279
  • published30 Jun 2026
  • disclosed24 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 24 Jun 2026

CVE-2026-11998  (opens in a new tab)
CWE-79  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mozjs60-devel package and not the mozjs60-devel package as distributed by Centos.

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.

SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.

This issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.

Note: The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the  End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .