Read the docs
TI-2026-39165 Aliases CVE-2026-54265GHSA-58w9-8g37-x9v5

Angular: Two-Way Property Binding Sanitization Bypass (XSS)

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Partial @angular/compiler (npm): 22.0.1, 21.2.17, 20.3.25Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangular>= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; up to 19.2.25—No fix listedCNA
—@angular/compiler (npm)22.0.0-next.0 to before 22.0.122.0.1Patch availableGHSA-58w9-8g37-x9v5
—@angular/compiler (npm)21.0.0-next.0 to before 21.2.1721.2.17Patch availableGHSA-58w9-8g37-x9v5
—@angular/compiler (npm)20.0.0-next.0 to before 20.3.2520.3.25Patch availableGHSA-58w9-8g37-x9v5
—@angular/compiler (npm)up to 19.2.25—No fix listedGHSA-58w9-8g37-x9v5
  • angular Vendorangular Affected >= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; up to 19.2.25 Fixed in — No fix listed CNA
  • @angular/compiler (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.1 Fixed in 22.0.1 Patch available GHSA-58w9-8g37-x9v5
  • @angular/compiler (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.17 Fixed in 21.2.17 Patch available GHSA-58w9-8g37-x9v5
  • @angular/compiler (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.25 Fixed in 20.3.25 Patch available GHSA-58w9-8g37-x9v5
  • @angular/compiler (npm) Vendor— Affected up to 19.2.25 Fixed in — No fix listed GHSA-58w9-8g37-x9v5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*up to 19.2.25; 20.0.0 to before 20.3.25; 21.0.0 to before 21.2.17; 22.0.0 to before 22.0.1Vulnerableangular
  • cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* Versions up to 19.2.25; 20.0.0 to before 20.3.25; 21.0.0 to before 21.2.17; 22.0.0 to before 22.0.1 Vulnerable ·angular

Remediation

  • Fix · GHSA-58w9-8g37-x9v5 @angular/compiler (npm) Fixed in 22.0.1 Advisory →
  • Fix · GHSA-58w9-8g37-x9v5 @angular/compiler (npm) Fixed in 21.2.17 Advisory →
  • Fix · GHSA-58w9-8g37-x9v5 @angular/compiler (npm) Fixed in 20.3.25 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 3AffectedNo fix yet: Fix deferred
Not affected: 8 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenStack Platform 16.2
  • Red Hat Quay 3
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54265
  2. 2026-10-03 Alias added: GHSA-58w9-8g37-x9v5

References

Patch 2

Advisory 2

Other 1

  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
  • TI-2026-36931 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CVSS 4.0HIGH 8.8
  • TI-2026-34131 Angular: SSRF via Hostname Hijacking in @angular/platform-server CVSS 4.0HIGH 8.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences