Read the docs
TI-2026-18171 Aliases CVE-2026-22610GHSA-jrmj-c5cx-3cw6

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix Partial angular (angular): 21.1.0-rc.0, 21.0.7, 20.3.16 +1@angular/compiler (npm): 21.1.0-rc.0, 21.0.7, 20.3.16 +1+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangular21.1.0-next.0 to before 21.1.0-rc.0; 21.0.0-next.0 to before 21.0.7; 20.0.0-next.0 to before 20.3.16; before 19.2.1821.1.0-rc.0, 21.0.7, 20.3.16, 19.2.18Patch availableCNA
—@angular/compiler (npm)21.1.0-next.0 to before 21.1.0-rc.021.1.0-rc.0Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/core (npm)21.1.0-next.0 to before 21.1.0-rc.021.1.0-rc.0Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/compiler (npm)21.0.0-next.0 to before 21.0.721.0.7Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/core (npm)21.0.0-next.0 to before 21.0.721.0.7Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/compiler (npm)20.0.0-next.0 to before 20.3.1620.3.16Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/core (npm)20.0.0-next.0 to before 20.3.1620.3.16Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/compiler (npm)19.0.0-next.0 to before 19.2.1819.2.18Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/core (npm)19.0.0-next.0 to before 19.2.1819.2.18Patch availableGHSA-jrmj-c5cx-3cw6
—@angular/compiler (npm)up to 18.2.14—No fix listedGHSA-jrmj-c5cx-3cw6
—@angular/core (npm)up to 18.2.14—No fix listedGHSA-jrmj-c5cx-3cw6
  • angular Vendorangular Affected 21.1.0-next.0 to before 21.1.0-rc.0; 21.0.0-next.0 to before 21.0.7; 20.0.0-next.0 to before 20.3.16; before 19.2.18 Fixed in 21.1.0-rc.0, 21.0.7, 20.3.16, 19.2.18 Patch available CNA
  • @angular/compiler (npm) Vendor— Affected 21.1.0-next.0 to before 21.1.0-rc.0 Fixed in 21.1.0-rc.0 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/core (npm) Vendor— Affected 21.1.0-next.0 to before 21.1.0-rc.0 Fixed in 21.1.0-rc.0 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/compiler (npm) Vendor— Affected 21.0.0-next.0 to before 21.0.7 Fixed in 21.0.7 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/core (npm) Vendor— Affected 21.0.0-next.0 to before 21.0.7 Fixed in 21.0.7 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/compiler (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.16 Fixed in 20.3.16 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/core (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.16 Fixed in 20.3.16 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/compiler (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.18 Fixed in 19.2.18 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/core (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.18 Fixed in 19.2.18 Patch available GHSA-jrmj-c5cx-3cw6
  • @angular/compiler (npm) Vendor— Affected up to 18.2.14 Fixed in — No fix listed GHSA-jrmj-c5cx-3cw6
  • @angular/core (npm) Vendor— Affected up to 18.2.14 Fixed in — No fix listed GHSA-jrmj-c5cx-3cw6

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*up to 18.2.14; 19.0.0 to before 19.2.18; 20.0.0 to before 20.3.16; 21.0.0 to before 21.0.7Vulnerableangular
cpe:2.3:a:angular:angular:21.1.0:next0:*:*:*:node.js:*:*21.1.0 next0Vulnerableangular
cpe:2.3:a:angular:angular:21.1.0:next1:*:*:*:node.js:*:*21.1.0 next1Vulnerableangular
cpe:2.3:a:angular:angular:21.1.0:next2:*:*:*:node.js:*:*21.1.0 next2Vulnerableangular
cpe:2.3:a:angular:angular:21.1.0:next3:*:*:*:node.js:*:*21.1.0 next3Vulnerableangular
cpe:2.3:a:angular:angular:21.1.0:next4:*:*:*:node.js:*:*21.1.0 next4Vulnerableangular
  • cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* Versions up to 18.2.14; 19.0.0 to before 19.2.18; 20.0.0 to before 20.3.16; 21.0.0 to before 21.0.7 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:21.1.0:next0:*:*:*:node.js:*:* Versions 21.1.0 next0 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:21.1.0:next1:*:*:*:node.js:*:* Versions 21.1.0 next1 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:21.1.0:next2:*:*:*:node.js:*:* Versions 21.1.0 next2 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:21.1.0:next3:*:*:*:node.js:*:* Versions 21.1.0 next3 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:21.1.0:next4:*:*:*:node.js:*:* Versions 21.1.0 next4 Vulnerable ·angular

Remediation

  • Fix · CNA angular (angular) Fixed in 21.1.0-rc.0, 21.0.7, 20.3.16, 19.2.18
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/compiler (npm) Fixed in 21.1.0-rc.0 Advisory →
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/core (npm) Fixed in 21.1.0-rc.0 Advisory →
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/compiler (npm) Fixed in 21.0.7 Advisory →
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/core (npm) Fixed in 21.0.7 Advisory →
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/compiler (npm) Fixed in 20.3.16 Advisory →
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/core (npm) Fixed in 20.3.16 Advisory →
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/compiler (npm) Fixed in 19.2.18 Advisory →
  • Fix · GHSA-jrmj-c5cx-3cw6 @angular/core (npm) Fixed in 19.2.18 Advisory →

Red Hat 2 advisories

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Not affected: 11 products
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Ceph Storage 9.2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenStack Platform 16.2
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22610
  2. 2026-10-03 Alias added: GHSA-jrmj-c5cx-3cw6
  3. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  4. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat

References

Patch 1

Advisory 2

Other 4

  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
  • TI-2026-36931 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CVSS 4.0HIGH 8.8
  • TI-2026-34131 Angular: SSRF via Hostname Hijacking in @angular/platform-server CVSS 4.0HIGH 8.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences