Linux Distros 未修补的漏洞：CVE-2026-88057
medium Nessus 插件 ID 344712
语言：
简介
Linux/Unix 主机上安装的一个或多个程序包存在漏洞，但供应商表示不会修补此漏洞。描述
Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。- Angular 是使用 TypeScript/JavaScript 和其他语言构建移动和桌面 Web 应用程序的开发平台。在 20.3.28、 21.2.20和 22.1.0之前版本中，@angular/core 和 @angular/compiler 中的 Angular 编译器和运行时可能会针对安全敏感指令主机绑定省略或选择错误的审查器，因为 SecurityContext 派生自声明指令或组件选择器，而非具体的主机元素。可以通过 hostDirectives 组合、继承的 HostBinding 声明、带有自定义 hostElement 或动态指令的 createComponent、SVG/MathML 命名空间元素和标签中立选择器（例如 ：not（...）来解决不匹配问题。因此，攻击者控制的 href、src、action、xlink：href 或数据值可在没有 Angular 内置审查器的情况下访问 DOM 属性，并在用户的浏览器上下文中执行任意 JavaScript。无法升级的应用程序可在分配前将 DomSanitizer.sanitize 与 SecurityContext.URL 一起使用，或将输入限制为经过验证的 HTTP 和 HTTPS URL 方案。在版本 20.3.28、 和 21.2.2022.1.0中修复了此问题。（CVE-2026-88057）
请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。
解决方案
目前尚未有任何已知的解决方案。另见
https://access.redhat.com/security/cve/cve-2026-88057
插件详情
严重性: Medium
ID: 344712
文件名: unpatched_CVE_2026_88057.nasl
版本: 1.3
类型: Local
代理: unix
系列: Misc.
发布时间: 2026/9/11
最近更新时间: 2026/9/11
支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: Medium
分数: 4.3
百分位: 53.43
CVSS v2
风险因素: Medium
基本分数: 5.8
时间分数: 4.9
矢量: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS 分数来源: CVE-2026-88057
CVSS v3
风险因素: High
基本分数: 8.2
时间分数: 7.5
矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
时间矢量: CVSS:3.0/E:U/RL:U/RC:C
CVSS v4
风险因素: Medium
Base Score: 5.3
Threat Score: 1.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
漏洞信息
CPE: cpe:/o:canonical:ubuntu_linux:16.04:-:lts, cpe:/o:canonical:ubuntu_linux:18.04:-:lts, cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, cpe:/o:canonical:ubuntu_linux:26.04:-:lts, cpe:/o:centos:centos:7, cpe:/o:centos:centos:8, cpe:/o:debian:debian_linux:12.0, cpe:/o:debian:debian_linux:13.0, cpe:/o:redhat:enterprise_linux:10, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:enterprise_linux:9, p-cpe:/a:canonical:ubuntu_linux:angular.js, p-cpe:/a:centos:centos:aspnetcore-runtime-6.0, p-cpe:/a:centos:centos:aspnetcore-runtime-7.0, p-cpe:/a:centos:centos:aspnetcore-targeting-pack-6.0, p-cpe:/a:centos:centos:aspnetcore-targeting-pack-7.0, p-cpe:/a:centos:centos:dotnet-apphost-pack-6.0, p-cpe:/a:centos:centos:dotnet-apphost-pack-7.0, p-cpe:/a:centos:centos:dotnet-host, p-cpe:/a:centos:centos:dotnet-hostfxr-6.0, p-cpe:/a:centos:centos:dotnet-hostfxr-7.0, p-cpe:/a:centos:centos:dotnet-runtime-6.0, p-cpe:/a:centos:centos:dotnet-runtime-7.0, p-cpe:/a:centos:centos:dotnet-sdk-6.0-source-built-artifacts, p-cpe:/a:centos:centos:dotnet-sdk-6.0, p-cpe:/a:centos:centos:dotnet-sdk-7.0-source-built-artifacts, p-cpe:/a:centos:centos:dotnet-sdk-7.0, p-cpe:/a:centos:centos:dotnet-targeting-pack-6.0, p-cpe:/a:centos:centos:dotnet-targeting-pack-7.0, p-cpe:/a:centos:centos:dotnet-templates-6.0, p-cpe:/a:centos:centos:dotnet-templates-7.0, p-cpe:/a:centos:centos:dotnet6.0, p-cpe:/a:centos:centos:dotnet7.0, p-cpe:/a:centos:centos:firefox-x11, p-cpe:/a:centos:centos:firefox, p-cpe:/a:centos:centos:gjs-devel, p-cpe:/a:centos:centos:gjs, p-cpe:/a:centos:centos:intel-cmt-cat-devel, p-cpe:/a:centos:centos:intel-cmt-cat, p-cpe:/a:centos:centos:librados-devel, p-cpe:/a:centos:centos:librados2, p-cpe:/a:centos:centos:libradospp-devel, p-cpe:/a:centos:centos:librbd-devel, p-cpe:/a:centos:centos:librbd1, p-cpe:/a:centos:centos:mozjs60-devel, p-cpe:/a:centos:centos:mozjs60, p-cpe:/a:centos:centos:netstandard-targeting-pack-2.1, p-cpe:/a:centos:centos:thunderbird, p-cpe:/a:debian:debian_linux:angular.js, p-cpe:/a:redhat:enterprise_linux:aspnetcore-runtime-6.0, p-cpe:/a:redhat:enterprise_linux:aspnetcore-runtime-7.0, p-cpe:/a:redhat:enterprise_linux:aspnetcore-targeting-pack-6.0, p-cpe:/a:redhat:enterprise_linux:aspnetcore-targeting-pack-7.0, p-cpe:/a:redhat:enterprise_linux:dotnet-apphost-pack-6.0, p-cpe:/a:redhat:enterprise_linux:dotnet-apphost-pack-7.0, p-cpe:/a:redhat:enterprise_linux:dotnet-host, p-cpe:/a:redhat:enterprise_linux:dotnet-hostfxr-6.0, p-cpe:/a:redhat:enterprise_linux:dotnet-hostfxr-7.0, p-cpe:/a:redhat:enterprise_linux:dotnet-runtime-6.0, p-cpe:/a:redhat:enterprise_linux:dotnet-runtime-7.0, p-cpe:/a:redhat:enterprise_linux:dotnet-sdk-6.0-source-built-artifacts, p-cpe:/a:redhat:enterprise_linux:dotnet-sdk-6.0, p-cpe:/a:redhat:enterprise_linux:dotnet-sdk-7.0-source-built-artifacts, p-cpe:/a:redhat:enterprise_linux:dotnet-sdk-7.0, p-cpe:/a:redhat:enterprise_linux:dotnet-targeting-pack-6.0, p-cpe:/a:redhat:enterprise_linux:dotnet-targeting-pack-7.0, p-cpe:/a:redhat:enterprise_linux:dotnet-templates-6.0, p-cpe:/a:redhat:enterprise_linux:dotnet-templates-7.0, p-cpe:/a:redhat:enterprise_linux:dotnet6.0, p-cpe:/a:redhat:enterprise_linux:dotnet7.0, p-cpe:/a:redhat:enterprise_linux:firefox-x11, p-cpe:/a:redhat:enterprise_linux:firefox, p-cpe:/a:redhat:enterprise_linux:gjs-devel, p-cpe:/a:redhat:enterprise_linux:gjs, p-cpe:/a:redhat:enterprise_linux:intel-cmt-cat-devel, p-cpe:/a:redhat:enterprise_linux:intel-cmt-cat, p-cpe:/a:redhat:enterprise_linux:librados-devel, p-cpe:/a:redhat:enterprise_linux:librados2, p-cpe:/a:redhat:enterprise_linux:libradospp-devel, p-cpe:/a:redhat:enterprise_linux:librbd-devel, p-cpe:/a:redhat:enterprise_linux:librbd1, p-cpe:/a:redhat:enterprise_linux:mozjs60-devel, p-cpe:/a:redhat:enterprise_linux:mozjs60, p-cpe:/a:redhat:enterprise_linux:netstandard-targeting-pack-2.1, p-cpe:/a:redhat:enterprise_linux:thunderbird
必需的 KB 项: Host/local_checks_enabled, Host/cpu, global_settings/vendor_unpatched, Host/OS/identifier
易利用性: No known exploits are available
漏洞发布日期: 2026/9/10
参考资料信息
CVE: CVE-2026-88057