{"uuid": "6058a6b7-4a95-44d0-b666-274527705da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://gist.github.com/alon710/bdd530b55ab23396bc2ee2dc380962dc", "content": "# CVE-2026-69151: CVE-2026-69151: Stored Cross-Site Scripting (XSS) in Angular Compiler i18n Pipeline via Event-Handler Attributes\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69151\n\n## Summary\nA high-severity security vulnerability has been identified within the Angular compiler's internationalization (i18n) metadata collection and translation pipeline. Angular implements strict defenses against client-side execution injection by validating standard attribute and property bindings. However, when parsing elements containing both i18n translation attributes and inline event-handler elements (such as `i18n-onerror`), the compiler failed to assert the safety of the target attribute. Consequently, compromised or untrusted localization translation source files can supply arbitrary JavaScript payloads that replace static event-handler bindings. This arbitrary code is compiled directly into the localized build bundle and executed dynamically by the web browser, bypassing runtime sanitization, security checks, and standard binding constraints.\n\n## TL;DR\nAn input validation flaw in the Angular compiler's i18n translation metadata pipeline enables unauthenticated stored Cross-Site Scripting (XSS) when utilizing untrusted translation assets. Attackers who compromise translation databases or localization files can inject arbitrary JavaScript executable payloads into translated attributes like `i18n-onerror`. Standard Angular runtime property-binding security validations fail to catch this injection because the malicious payloads are rendered as static attributes in the compiled HTML document, enabling full client-side session compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n- **Attack Vector**: Network / Content Supply Chain Injection\n- **Attack Complexity**: Low (No special conditions required)\n- **Authentication Requirements**: None (Requires access to influence external translation resources)\n- **CVSS v4.0 Base Score**: 7.6 (High)\n- **Exploit Status**: Proof-of-Concept (No known active exploitation in the wild)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Angular compiler (@angular/compiler)\n- Angular core runtime (@angular/core)\n- **@angular/compiler**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/compiler**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/compiler**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n- **@angular/core**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/core**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/core**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n\n## Mitigation\n\n- Upgrade Angular compiler and core libraries to patched versions (20.3.27, 21.2.19, or 22.0.1)\n- Audit existing HTML templates to ensure event handlers are never marked for translation via i18n-on* attributes\n- Treat translation metadata files (XLF, XLIFF, JSON) as high-risk assets and enforce strict code review pipelines\n- Enforce a rigorous Content Security Policy (CSP) that bans the 'unsafe-inline' script directive\n\n**Remediation Steps:**\n1. Open the project package.json file and identify the versions of @angular/compiler and @angular/core.\n2. Execute the update command matching your current release branch (e.g., 'npm install @angular/core@20.3.27 @angular/compiler@20.3.27' or corresponding yarn/pnpm equivalent).\n3. Configure static analysis linter rules to flag patterns matching i18n-on* attributes in template HTML structures.\n4. Validate the build logs post-upgrade to confirm that any accidental event-handler translation directives throw compile-time exceptions.\n\n## References\n\n- [NVD CVE Record - CVE-2026-69151](https://www.cve.org/CVERecord?id=CVE-2026-69151)\n- [GitHub Security Advisory GHSA-jj27-h5hq-8x99](https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99)\n- [Angular Git Core Fix Commit](https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865)\n- [Angular Git Follow-up Refinement Commit](https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69151) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T19:31:37.187220Z"}