THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-f6mr-pjwc-34m4 (high) — Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

[GHSA] GHSA-f6mr-pjwc-34m4 (high) — Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

highgithub_advisoriesPublished 2026-09-10

GHSA-f6mr-pjwc-34m4 Severity: high CVE: CVE-2026-88056

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

### Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.

### Technical Desc

MITRE ATT&CK techniques

JavaScriptT1059.007
CredentialsT1589.001

Indicators of compromise

CVE-2026-88056cve
http://trusted-origin/%C2%A0//attacker.example/collect`url
http://attacker.example/collect`url

Original source: https://github.com/advisories/GHSA-f6mr-pjwc-34m4