CVE-2026-22610: Google Angular XSS in SVG script element attributes

CVE-2026-22610 · Severity: high · CVSS 6.1 · Published 2026-01-10

Angular, a popular web development framework, contains a security flaw that could allow attackers to run malicious code in a user's browser. This occurs when an application uses specific SVG graphics elements that are linked to untrusted data. If exploited, an attacker could steal login sessions, access sensitive user information, or perform unauthorized actions on behalf of the user.

Technologies: @angular/compiler (npm), @angular/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-22610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22610 being exploited in the wild.
How severe is CVE-2026-22610?
High severity, with a CVSS score of 6.1, published 10 January 2026.
Which products and versions are affected?
@angular/compiler (npm) SEMVER:introduced=21.1.0-next.0,fixed=21.1.0-rc.0; @angular/core (npm) SEMVER:introduced=21.1.0-next.0,fixed=21.1.0-rc.0.
Is there a fix for CVE-2026-22610?
Yes. @angular/compiler (npm): upgrade to 21.1.0-rc.0 or later; @angular/core (npm): upgrade to 21.1.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22610 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22610?
Check whether you run @angular/compiler (npm) or @angular/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/compiler (npm): upgrade to 21.1.0-rc.0 or later
    npm install @angular/compiler@21.1.0-rc.0
  • @angular/core (npm): upgrade to 21.1.0-rc.0 or later
    npm install @angular/core@21.1.0-rc.0

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Angular Template Compiler because it fails to recognize the 'href' and 'xlink:href' attributes of SVG <script> elements as a Resource URL context. Consequently, the internal sanitization schema treats these attributes as standard strings rather than sensitive resource links. An attacker can exploit this by providing a malicious payload, such as a 'data:text/javascript' URI, through template bindings (e.g., [attr.href]). Successful exploitation requires the application to use SVG <script> elements with property or attribute bindings derived from untrusted sources. Patches are available in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

Affected products

  • Angular @angular/compiler <= 18.2.14, >= 19.0.0-next.0, < 19.2.18, >= 20.0.0-next.0, < 20.3.16, >= 21.0.0-next.0, < 21.0.7, >= 21.1.0-next.0, < 21.1.0-rc.0
  • Angular @angular/core <= 18.2.14, >= 19.0.0-next.0, < 19.2.18, >= 20.0.0-next.0, < 20.3.16, >= 21.0.0-next.0, < 21.0.7, >= 21.1.0-next.0, < 21.1.0-rc.0

Identifiers

  • CVE-2026-22610
  • GHSA-jrmj-c5cx-3cw6

Timeline

  • 2026-01-08: disclosed
  • 2026-01-09: advisory: GitHub Advisory published
  • 2026-01-10: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.