Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by @angular
CVE-2026-69151 (GCVE-0-2026-69151)
Vulnerability from nvd – Published: 2026-08-03 16:23 – Updated: 2026-08-03 21:19
VLAI
EPSS
VEX
Title
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68821 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69306 | x_refsource_MISC |
| https://github.com/angular/angular/commit/417a407… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6c41f5c… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | compiler |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | core |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T21:17:58.775539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T21:19:24.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "compiler",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "core",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:23:34.121Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99"
},
{
"name": "https://github.com/angular/angular/pull/68821",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68821"
},
{
"name": "https://github.com/angular/angular/pull/69306",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69306"
},
{
"name": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e"
},
{
"name": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865"
}
],
"source": {
"advisory": "GHSA-jj27-h5hq-8x99",
"discovery": "UNKNOWN"
},
"title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69151",
"datePublished": "2026-08-03T16:23:34.121Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T21:19:24.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69149 (GCVE-0-2026-69149)
Vulnerability from nvd – Published: 2026-08-03 16:14 – Updated: 2026-08-03 20:33
VLAI
EPSS
VEX
Title
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/69675 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69714 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69929 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69930 | x_refsource_MISC |
| https://github.com/angular/domino/pull/32 | x_refsource_MISC |
| https://github.com/angular/domino/commit/f88e5aa4… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
|
| @angular | platform-server |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:33:37.200757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:33:46.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
},
{
"product": "platform-server",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (\u003ciframe\u003e, \u003cnoembed\u003e, \u003cnoframes\u003e, and \u003cnoscript\u003e). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:14:39.636Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
},
{
"name": "https://github.com/angular/angular/pull/69675",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69675"
},
{
"name": "https://github.com/angular/angular/pull/69714",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69714"
},
{
"name": "https://github.com/angular/angular/pull/69929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69929"
},
{
"name": "https://github.com/angular/angular/pull/69930",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69930"
},
{
"name": "https://github.com/angular/domino/pull/32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/pull/32"
},
{
"name": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
}
],
"source": {
"advisory": "GHSA-vpx6-8pjr-4g3v",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69149",
"datePublished": "2026-08-03T16:14:39.636Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T20:33:46.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68945 (GCVE-0-2026-68945)
Vulnerability from nvd – Published: 2026-08-03 15:58 – Updated: 2026-08-03 16:58
VLAI
EPSS
VEX
Title
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68571 | x_refsource_MISC |
| https://github.com/angular/angular/commit/6867f77… | x_refsource_MISC |
| https://github.com/angular/angular/commit/948a8d6… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a64e288… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a6c7fc5… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T16:58:17.198889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:58:26.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
},
{
"product": "common",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:58:02.299Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
},
{
"name": "https://github.com/angular/angular/pull/68571",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68571"
},
{
"name": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
},
{
"name": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
},
{
"name": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
},
{
"name": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
}
],
"source": {
"advisory": "GHSA-jhpw-976m-542j",
"discovery": "UNKNOWN"
},
"title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68945",
"datePublished": "2026-08-03T15:58:02.299Z",
"dateReserved": "2026-07-31T21:49:24.928Z",
"dateUpdated": "2026-08-03T16:58:26.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32635 (GCVE-0-2026-32635)
Vulnerability from nvd – Published: 2026-03-13 20:58 – Updated: 2026-03-17 03:55
VLAI
EPSS
VEX
Title
Angular has XSS in i18n attribute bindings
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/67541 | x_refsource_MISC |
| https://github.com/angular/angular/pull/67561 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| @angular | compiler |
Affected:
>= 22.0.0-next.0, < 22.0.0-next.3
Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20 |
|
| @angular | core |
Affected:
>= 22.0.0-next.0, < 22.0.0-next.3
Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T03:55:33.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compiler",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
},
{
"status": "affected",
"version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
}
]
},
{
"product": "core",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
},
{
"status": "affected",
"version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular\u0027s ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-\u003cattribute\u003e name bypasses Angular\u0027s built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T20:58:12.554Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222"
},
{
"name": "https://github.com/angular/angular/pull/67541",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/67541"
},
{
"name": "https://github.com/angular/angular/pull/67561",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/67561"
}
],
"source": {
"advisory": "GHSA-g93w-mfhg-p222",
"discovery": "UNKNOWN"
},
"title": "Angular has XSS in i18n attribute bindings"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32635",
"datePublished": "2026-03-13T20:58:12.554Z",
"dateReserved": "2026-03-12T15:29:36.559Z",
"dateUpdated": "2026-03-17T03:55:33.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69151 (GCVE-0-2026-69151)
Vulnerability from cvelistv5 – Published: 2026-08-03 16:23 – Updated: 2026-08-03 21:19
VLAI
EPSS
VEX
Title
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68821 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69306 | x_refsource_MISC |
| https://github.com/angular/angular/commit/417a407… | x_refsource_MISC |
| https://github.com/angular/angular/commit/6c41f5c… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | compiler |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
|
| @angular | core |
Affected:
>= 22.0.0-next.0, < 22.0.1
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T21:17:58.775539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T21:19:24.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "compiler",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
},
{
"product": "core",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003c 20.3.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:23:34.121Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99"
},
{
"name": "https://github.com/angular/angular/pull/68821",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68821"
},
{
"name": "https://github.com/angular/angular/pull/69306",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69306"
},
{
"name": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e"
},
{
"name": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865"
}
],
"source": {
"advisory": "GHSA-jj27-h5hq-8x99",
"discovery": "UNKNOWN"
},
"title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69151",
"datePublished": "2026-08-03T16:23:34.121Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T21:19:24.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69149 (GCVE-0-2026-69149)
Vulnerability from cvelistv5 – Published: 2026-08-03 16:14 – Updated: 2026-08-03 20:33
VLAI
EPSS
VEX
Title
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/69675 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69714 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69929 | x_refsource_MISC |
| https://github.com/angular/angular/pull/69930 | x_refsource_MISC |
| https://github.com/angular/domino/pull/32 | x_refsource_MISC |
| https://github.com/angular/domino/commit/f88e5aa4… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| angular | angular |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
|
| @angular | platform-server |
Affected:
< 20.3.27
Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:33:37.200757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:33:46.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
},
{
"product": "platform-server",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (\u003ciframe\u003e, \u003cnoembed\u003e, \u003cnoframes\u003e, and \u003cnoscript\u003e). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:14:39.636Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
},
{
"name": "https://github.com/angular/angular/pull/69675",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69675"
},
{
"name": "https://github.com/angular/angular/pull/69714",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69714"
},
{
"name": "https://github.com/angular/angular/pull/69929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69929"
},
{
"name": "https://github.com/angular/angular/pull/69930",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/69930"
},
{
"name": "https://github.com/angular/domino/pull/32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/pull/32"
},
{
"name": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
}
],
"source": {
"advisory": "GHSA-vpx6-8pjr-4g3v",
"discovery": "UNKNOWN"
},
"title": "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69149",
"datePublished": "2026-08-03T16:14:39.636Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-08-03T20:33:46.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68945 (GCVE-0-2026-68945)
Vulnerability from cvelistv5 – Published: 2026-08-03 15:58 – Updated: 2026-08-03 16:58
VLAI
EPSS
VEX
Title
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/68571 | x_refsource_MISC |
| https://github.com/angular/angular/commit/6867f77… | x_refsource_MISC |
| https://github.com/angular/angular/commit/948a8d6… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a64e288… | x_refsource_MISC |
| https://github.com/angular/angular/commit/a6c7fc5… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T16:58:17.198889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:58:26.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "angular",
"vendor": "angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
},
{
"product": "common",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003c 20.3.27"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
},
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:58:02.299Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
},
{
"name": "https://github.com/angular/angular/pull/68571",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/68571"
},
{
"name": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
},
{
"name": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
},
{
"name": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
},
{
"name": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
}
],
"source": {
"advisory": "GHSA-jhpw-976m-542j",
"discovery": "UNKNOWN"
},
"title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68945",
"datePublished": "2026-08-03T15:58:02.299Z",
"dateReserved": "2026-07-31T21:49:24.928Z",
"dateUpdated": "2026-08-03T16:58:26.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32635 (GCVE-0-2026-32635)
Vulnerability from cvelistv5 – Published: 2026-03-13 20:58 – Updated: 2026-03-17 03:55
VLAI
EPSS
VEX
Title
Angular has XSS in i18n attribute bindings
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/angular/angular/security/advis… | x_refsource_CONFIRM |
| https://github.com/angular/angular/pull/67541 | x_refsource_MISC |
| https://github.com/angular/angular/pull/67561 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| @angular | compiler |
Affected:
>= 22.0.0-next.0, < 22.0.0-next.3
Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20 |
|
| @angular | core |
Affected:
>= 22.0.0-next.0, < 22.0.0-next.3
Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T03:55:33.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compiler",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
},
{
"status": "affected",
"version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
}
]
},
{
"product": "core",
"vendor": "@angular",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
},
{
"status": "affected",
"version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
},
{
"status": "affected",
"version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
},
{
"status": "affected",
"version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular\u0027s ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-\u003cattribute\u003e name bypasses Angular\u0027s built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T20:58:12.554Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222"
},
{
"name": "https://github.com/angular/angular/pull/67541",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/67541"
},
{
"name": "https://github.com/angular/angular/pull/67561",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/angular/angular/pull/67561"
}
],
"source": {
"advisory": "GHSA-g93w-mfhg-p222",
"discovery": "UNKNOWN"
},
"title": "Angular has XSS in i18n attribute bindings"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32635",
"datePublished": "2026-03-13T20:58:12.554Z",
"dateReserved": "2026-03-12T15:29:36.559Z",
"dateUpdated": "2026-03-17T03:55:33.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}