Executive brief
Angular, a popular web development framework, contains a security flaw that could allow attackers to run malicious code in a user's browser. This occurs when an application uses specific SVG graphics elements that are linked to untrusted data. If exploited, an attacker could steal login sessions, access sensitive user information, or perform unauthorized actions on behalf of the user.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Angular Template Compiler because it fails to recognize the 'href' and 'xlink:href' attributes of SVG <script> elements as a Resource URL context. Consequently, the internal sanitization schema treats these attributes as standard strings rather than sensitive resource links. An attacker can exploit this by providing a malicious payload, such as a 'data:text/javascript' URI, through template bindings (e.g., [attr.href]). Successful exploitation requires the application to use SVG <script> elements with property or attribute bindings derived from untrusted sources. Patches are available in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.
Affected products
- Angular @angular/compiler <= 18.2.14, >= 19.0.0-next.0, < 19.2.18, >= 20.0.0-next.0, < 20.3.16, >= 21.0.0-next.0, < 21.0.7, >= 21.1.0-next.0, < 21.1.0-rc.0
- Angular @angular/core <= 18.2.14, >= 19.0.0-next.0, < 19.2.18, >= 20.0.0-next.0, < 20.3.16, >= 21.0.0-next.0, < 21.0.7, >= 21.1.0-next.0, < 21.1.0-rc.0
Timeline
- 2026-01-08: disclosed
- 2026-01-09: advisory: GitHub Advisory published
- 2026-01-10: other: NVD published