Angular has XSS in i18n attribute bindings
Priority MEDIUM 40CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00473 41st percentileScored 2026-11-07
Fix Partial compiler (@angular): 22.0.0-next.3, 21.2.4, 20.3.18 +1core (@angular): 22.0.0-next.3, 21.2.4, 20.3.18 +1+2 more productsRed Hat: 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| angular | compiler | 22.0.0-next.0 to before 22.0.0-next.3; 21.0.0-next.0 to before 21.2.4; 20.0.0-next.0 to before 20.3.18; 17.0.0.next.0 to before 19.2.20 | 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 | Patch available | CNA |
| angular | core | 22.0.0-next.0 to before 22.0.0-next.3; 21.0.0-next.0 to before 21.2.4; 20.0.0-next.0 to before 20.3.18; 17.0.0.next.0 to before 19.2.20 | 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 | Patch available | CNA |
| — | @angular/core (npm) | 22.0.0-next.0 to before 22.0.0-next.3 | 22.0.0-next.3 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/core (npm) | 21.0.0-next.0 to before 21.2.4 | 21.2.4 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/core (npm) | 20.0.0-next.0.0.0 to before 20.3.18 | 20.3.18 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/core (npm) | 19.0.0-next.0 to before 19.2.20 | 19.2.20 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/core (npm) | 17.0.0-next.0 – 18.2.14 | — | No fix listed | GHSA-g93w-mfhg-p222 |
| — | @angular/compiler (npm) | 22.0.0-next.0 to before 22.0.0-next.3 | 22.0.0-next.3 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/compiler (npm) | 21.0.0-next.0 to before 21.2.4 | 21.2.4 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/compiler (npm) | 20.0.0-next.0.0.0 to before 20.3.18 | 20.3.18 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/compiler (npm) | 19.0.0-next.0 to before 19.2.20 | 19.2.20 | Patch available | GHSA-g93w-mfhg-p222 |
| — | @angular/compiler (npm) | 17.0.0-next.0 – 18.2.14 | — | No fix listed | GHSA-g93w-mfhg-p222 |
- compiler Vendorangular Affected 22.0.0-next.0 to before 22.0.0-next.3; 21.0.0-next.0 to before 21.2.4; 20.0.0-next.0 to before 20.3.18; 17.0.0.next.0 to before 19.2.20 Fixed in 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 Patch available CNA
- core Vendorangular Affected 22.0.0-next.0 to before 22.0.0-next.3; 21.0.0-next.0 to before 21.2.4; 20.0.0-next.0 to before 20.3.18; 17.0.0.next.0 to before 19.2.20 Fixed in 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 Patch available CNA
- @angular/core (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-next.3 Fixed in 22.0.0-next.3 Patch available GHSA-g93w-mfhg-p222
- @angular/core (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.4 Fixed in 21.2.4 Patch available GHSA-g93w-mfhg-p222
- @angular/core (npm) Vendor— Affected 20.0.0-next.0.0.0 to before 20.3.18 Fixed in 20.3.18 Patch available GHSA-g93w-mfhg-p222
- @angular/core (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.20 Fixed in 19.2.20 Patch available GHSA-g93w-mfhg-p222
- @angular/core (npm) Vendor— Affected 17.0.0-next.0 – 18.2.14 Fixed in — No fix listed GHSA-g93w-mfhg-p222
- @angular/compiler (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-next.3 Fixed in 22.0.0-next.3 Patch available GHSA-g93w-mfhg-p222
- @angular/compiler (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.4 Fixed in 21.2.4 Patch available GHSA-g93w-mfhg-p222
- @angular/compiler (npm) Vendor— Affected 20.0.0-next.0.0.0 to before 20.3.18 Fixed in 20.3.18 Patch available GHSA-g93w-mfhg-p222
- @angular/compiler (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.20 Fixed in 19.2.20 Patch available GHSA-g93w-mfhg-p222
- @angular/compiler (npm) Vendor— Affected 17.0.0-next.0 – 18.2.14 Fixed in — No fix listed GHSA-g93w-mfhg-p222
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:angular:angular_cli:*:*:*:*:*:*:*:* | 17.0.0 to before 19.2.0; 20.0.0 – 20.3.18; 21.0.0 to before 21.2.4 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next0:*:*:*:*:*:* | 22.0.0 next0 | Vulnerable | angular |
| cpe:2.3:a:angular:angular_cli:22.0.0:next1:*:*:*:*:*:* | 22.0.0 next1 | Vulnerable | angular |
- cpe:2.3:a:angular:angular_cli:*:*:*:*:*:*:*:* Versions 17.0.0 to before 19.2.0; 20.0.0 – 20.3.18; 21.0.0 to before 21.2.4 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next0:*:*:*:*:*:* Versions 22.0.0 next0 Vulnerable ·angular
- cpe:2.3:a:angular:angular_cli:22.0.0:next1:*:*:*:*:*:* Versions 22.0.0 next1 Vulnerable ·angular
Remediation
- Fix · CNA compiler (@angular) Fixed in 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20
- Fix · CNA core (@angular) Fixed in 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20
- Fix · GHSA-g93w-mfhg-p222 @angular/core (npm) Fixed in 22.0.0-next.3 Advisory →
- Fix · GHSA-g93w-mfhg-p222 @angular/core (npm) Fixed in 21.2.4 Advisory →
- Fix · GHSA-g93w-mfhg-p222 @angular/core (npm) Fixed in 20.3.18 Advisory →
- Fix · GHSA-g93w-mfhg-p222 @angular/core (npm) Fixed in 19.2.20 Advisory →
- Fix · GHSA-g93w-mfhg-p222 @angular/compiler (npm) Fixed in 22.0.0-next.3 Advisory →
- Fix · GHSA-g93w-mfhg-p222 @angular/compiler (npm) Fixed in 21.2.4 Advisory →
- Fix · GHSA-g93w-mfhg-p222 @angular/compiler (npm) Fixed in 20.3.18 Advisory →
- Fix · GHSA-g93w-mfhg-p222 @angular/compiler (npm) Fixed in 19.2.20 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32635
- 2026-10-03 Alias added: GHSA-g93w-mfhg-p222
- 2026-10-25 Priority changed: MEDIUM → LOW
- 2026-10-26 Priority changed: LOW → MEDIUM
References
Advisory 2
Other 5
- https://github.com/angular/angular/commit/224e60ecb1b90115baa702f1c06edc1d64d86187
- https://github.com/angular/angular/commit/78dea55351fb305b33a919c43a6b363137eca166
- https://github.com/angular/angular/commit/8630319f74c9575a21693d875cc7d5252516146d
- https://github.com/angular/angular/commit/ed2d324f9cc12aab6cfa0569ef10b73243a62c65
- https://github.com/angular/angular
More Angular Cli vulnerabilities
- TI-2026-32378 Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9
- TI-2026-25794 Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-32635 · CVE Program
- CVE-2026-32635 · NVD
- FIRST EPSS
- GHSA-g93w-mfhg-p222 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32635 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences