AIKIDO-2026-10989

TL;DR

Angular SSR URL parsing in @angular/platform-server can be tricked into adopting attacker-controlled origins or bypassing allowedHosts checks. Malformed absolute URLs accepted by lenient parsers, protocol-relative paths, and unsafe config.url values passed to document initialization can hijack PlatformLocation or virtual document origins. Relative HttpClient calls and hostname-derived URLs may then target attacker-controlled hosts. The patch centralizes hardened parseUrl normalization, rejects malformed absolute URLs, and validates URLs before document initialization.