CVE-2026-41468: Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection
Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41468?
CVE-2026-41468 is classified as a critical vulnerability due to the potential for remote code execution through sandbox escape.
What software is affected by CVE-2026-41468?
CVE-2026-41468 affects Beghelli Sicuro24 SicuroWeb and Google AngularJS version 1.5.2.
How do I fix CVE-2026-41468?
To fix CVE-2026-41468, it is recommended to upgrade to a later version of AngularJS that does not contain the known sandbox escape vulnerabilities.
What are the risks associated with CVE-2026-41468?
The risks of CVE-2026-41468 include unauthorized access and manipulation of the application, leading to potential data breaches and service disruptions.
How does CVE-2026-41468 allow sandbox escape?
CVE-2026-41468 allows sandbox escape through template injection combined with known AngularJS escape primitives.