CVE-2026-69151

HIGH

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Title source: cna
STIX 2.1

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

References (5)

Core 5

Scores

CVSS v4 7.6
EPSS 0.0033
EPSS Percentile 25.3%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (17)
@angular/compiler < 20.3.27
@angular/compiler >= 21.0.0-next.0, < 21.2.19
@angular/compiler >= 22.0.0-next.0, < 22.0.1
@angular/core < 20.3.27
@angular/core >= 21.0.0-next.0, < 21.2.19
@angular/core >= 22.0.0-next.0, < 22.0.1
angular/angular < 20.3.27
angular/angular >= 21.0.0-next.0, < 21.2.19
angular/angular >= 22.0.0-next.0, < 22.0.1
angular/compiler 0 - 19.2.25npm
... and 7 more
Published Aug 03, 2026
Tracked Since Aug 03, 2026