CVE Explorer
CVE-2026-27738
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic normalizes URL segments by stripping leading slashes; however, it only removes a single leading slash. When an Angular SSR application is deployed behind a proxy that passes the `X-Forwarded-Prefix` header
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"angular-cli","vendor":"angular","versions":[{"status":"affected","version":">= 21.2.0-next.2, < 21.2.0-rc.0"},{"status":"affected","version":">= 21.0.0-next.0, < 21.1.5"},{"status":"affected","version":">= 20.0.0-next.0, < 20.3.17"},{"status":"affected","version":">= 19.0.0-next.0, < 19.2.21"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"name":"https://github.com/angular/angular-cli/commit/877f017ace4b83277d773aa37f5813e5e9faec7e","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular-cli/commit/877f017ace4b83277d773aa37f5813e5e9faec7e"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/cna/references/3
{"tags":["exploit"],"url":"https://github.com/angular/angular-cli/issues/32501"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/adp/0/references/0
{"name":"https://github.com/angular/angular-cli/issues/32501","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular-cli/issues/32501"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/cna/references/1
{"name":"https://github.com/angular/angular-cli/pull/32521","tags":["x_refsource_MISC"],"url":"https://github.com/angular/angular-cli/pull/32521"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/cna/references/2
{"name":"https://github.com/angular/angular-cli/security/advisories/GHSA-xh43-g2fq-wjrj","tags":["x_refsource_CONFIRM"],"url":"https://github.com/angular/angular-cli/security/advisories/GHSA-xh43-g2fq-wjrj"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:51784818192d8e2bc07694df003d9ae752fc894fe87033899e0f80f1ff949572 · sha256:87fbf706b1c562bb… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.