Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-07
Fix Partial @angular/core (npm): 21.2.15, 22.0.0-rc.2, 20.3.22 +1@angular/compiler (npm): 21.2.15, 22.0.0-rc.2, 20.3.22 +1Red Hat: 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| angular | angular | >= 21.0.0-next.0 < 21.2.15; >= 22.0.0-next.0 < 22.0.0-rc.2; >= 20.0.0-next.0 < 20.3.22; >= 19.0.0-next.0 < 19.2.22; up to 18.2.14 | — | No fix listed | CNA |
| — | @angular/core (npm) | 21.0.0-next.0 to before 21.2.15 | 21.2.15 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/core (npm) | 22.0.0-next.0 to before 22.0.0-rc.2 | 22.0.0-rc.2 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/core (npm) | 20.0.0-next.0 to before 20.3.22 | 20.3.22 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/core (npm) | 19.0.0-next.0 to before 19.2.22 | 19.2.22 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/core (npm) | up to 18.2.14 | — | No fix listed | GHSA-f3m7-gqxr-g87x |
| — | @angular/compiler (npm) | 21.0.0-next.0 to before 21.2.15 | 21.2.15 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/compiler (npm) | 22.0.0-next.0 to before 22.0.0-rc.2 | 22.0.0-rc.2 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/compiler (npm) | 20.0.0-next.0 to before 20.3.22 | 20.3.22 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/compiler (npm) | 19.0.0-next.0 to before 19.2.22 | 19.2.22 | Patch available | GHSA-f3m7-gqxr-g87x |
| — | @angular/compiler (npm) | up to 18.2.14 | — | No fix listed | GHSA-f3m7-gqxr-g87x |
- angular Vendorangular Affected >= 21.0.0-next.0 < 21.2.15; >= 22.0.0-next.0 < 22.0.0-rc.2; >= 20.0.0-next.0 < 20.3.22; >= 19.0.0-next.0 < 19.2.22; up to 18.2.14 Fixed in — No fix listed CNA
- @angular/core (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.15 Fixed in 21.2.15 Patch available GHSA-f3m7-gqxr-g87x
- @angular/core (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-rc.2 Fixed in 22.0.0-rc.2 Patch available GHSA-f3m7-gqxr-g87x
- @angular/core (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.22 Fixed in 20.3.22 Patch available GHSA-f3m7-gqxr-g87x
- @angular/core (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.22 Fixed in 19.2.22 Patch available GHSA-f3m7-gqxr-g87x
- @angular/core (npm) Vendor— Affected up to 18.2.14 Fixed in — No fix listed GHSA-f3m7-gqxr-g87x
- @angular/compiler (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.15 Fixed in 21.2.15 Patch available GHSA-f3m7-gqxr-g87x
- @angular/compiler (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-rc.2 Fixed in 22.0.0-rc.2 Patch available GHSA-f3m7-gqxr-g87x
- @angular/compiler (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.22 Fixed in 20.3.22 Patch available GHSA-f3m7-gqxr-g87x
- @angular/compiler (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.22 Fixed in 19.2.22 Patch available GHSA-f3m7-gqxr-g87x
- @angular/compiler (npm) Vendor— Affected up to 18.2.14 Fixed in — No fix listed GHSA-f3m7-gqxr-g87x
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* | up to 18.2.14; 19.0.0 to before 19.2.22; 20.0.0 to before 20.3.22; 21.0.0 to before 21.2.15 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:* | 22.0.0 next0 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:* | 22.0.0 next1 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:* | 22.0.0 next10 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:* | 22.0.0 next11 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:* | 22.0.0 next12 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:* | 22.0.0 next2 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:* | 22.0.0 next3 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:* | 22.0.0 next4 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:* | 22.0.0 next5 | Vulnerable | angular |
- cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* Versions up to 18.2.14; 19.0.0 to before 19.2.22; 20.0.0 to before 20.3.22; 21.0.0 to before 21.2.15 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:* Versions 22.0.0 next0 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:* Versions 22.0.0 next1 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:* Versions 22.0.0 next10 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:* Versions 22.0.0 next11 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:* Versions 22.0.0 next12 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:* Versions 22.0.0 next2 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:* Versions 22.0.0 next3 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:* Versions 22.0.0 next4 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:* Versions 22.0.0 next5 Vulnerable ·angular
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:* | 22.0.0 next6 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:* | 22.0.0 next7 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:* | 22.0.0 next8 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:* | 22.0.0 next9 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:* | 22.0.0 rc0 | Vulnerable | angular |
| cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:* | 22.0.0 rc1 | Vulnerable | angular |
- cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:* Versions 22.0.0 next6 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:* Versions 22.0.0 next7 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:* Versions 22.0.0 next8 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:* Versions 22.0.0 next9 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:* Versions 22.0.0 rc0 Vulnerable ·angular
- cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:* Versions 22.0.0 rc1 Vulnerable ·angular
Remediation
- Fix · GHSA-f3m7-gqxr-g87x @angular/core (npm) Fixed in 21.2.15 Advisory →
- Fix · GHSA-f3m7-gqxr-g87x @angular/core (npm) Fixed in 22.0.0-rc.2 Advisory →
- Fix · GHSA-f3m7-gqxr-g87x @angular/core (npm) Fixed in 20.3.22 Advisory →
- Fix · GHSA-f3m7-gqxr-g87x @angular/core (npm) Fixed in 19.2.22 Advisory →
- Fix · GHSA-f3m7-gqxr-g87x @angular/compiler (npm) Fixed in 21.2.15 Advisory →
- Fix · GHSA-f3m7-gqxr-g87x @angular/compiler (npm) Fixed in 22.0.0-rc.2 Advisory →
- Fix · GHSA-f3m7-gqxr-g87x @angular/compiler (npm) Fixed in 20.3.22 Advisory →
- Fix · GHSA-f3m7-gqxr-g87x @angular/compiler (npm) Fixed in 19.2.22 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
Not affected: 8 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenStack Platform 16.2
- Red Hat Quay 3
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50557
- 2026-10-03 Alias added: GHSA-f3m7-gqxr-g87x
References
More Angular vulnerabilities
- TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
- TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
- TI-2026-36931 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CVSS 4.0HIGH 8.8
- TI-2026-34131 Angular: SSRF via Hostname Hijacking in @angular/platform-server CVSS 4.0HIGH 8.8
Sources
- CVE-2026-50557 · CVE Program
- CVE-2026-50557 · NVD
- FIRST EPSS
- GHSA-f3m7-gqxr-g87x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-50557 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences