CVE-2026-32635: Angular XSS in i18n attribute bindings

CVE-2026-32635 · Severity: low · CVSS 3.1 · Published 2026-03-13

Angular, a popular JavaScript framework for building web applications, contains a cross-site scripting (XSS) vulnerability in its internationalization (i18n) feature. When developers mark security-sensitive HTML attributes (like href, src, or action) for internationalization and bind them to user-supplied data, Angular's built-in sanitization is bypassed, allowing attackers to inject malicious scripts. This can lead to session hijacking, data theft, and unauthorized actions on behalf of users.

Technologies: @angular/compiler (npm), @angular/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-32635 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32635 being exploited in the wild.
How severe is CVE-2026-32635?
Low severity, with a CVSS score of 3.1, published 13 March 2026.
Which products and versions are affected?
@angular/compiler (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.3; @angular/core (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.3.
Is there a fix for CVE-2026-32635?
Yes. @angular/compiler (npm): upgrade to 22.0.0-next.3 or later; @angular/core (npm): upgrade to 22.0.0-next.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32635 attacked?
It is attacked over the network.
Am I affected by CVE-2026-32635?
Check whether you run @angular/compiler (npm) or @angular/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/compiler (npm): upgrade to 22.0.0-next.3 or later
    npm install @angular/compiler@22.0.0-next.3
  • @angular/core (npm): upgrade to 22.0.0-next.3 or later
    npm install @angular/core@22.0.0-next.3

Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in Angular's runtime and compiler. The root cause is that Angular's sanitization mechanism is bypassed when a security-sensitive attribute (href, src, action, etc.) is marked for internationalization via the i18n-<attribute> directive and bound to data using template expressions (e.g., {{maliciousUrl}}). An attacker exploits this by injecting malicious URLs or JavaScript code into untrusted sources (user input, API responses) that flow into these attributes. The attack vector is network-based and requires the application to use a vulnerable Angular version while binding unsanitized user input to a marked attribute. Patches are available in Angular versions 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20; older versions (17.x–18.2.14) are unpatched.

Affected products

  • Google Angular 19.0.0-next.0 to 19.2.19; 20.0.0-next.0 to 20.3.17; 21.0.0-next.0 to 21.2.3; 22.0.0-next.0 to 22.0.0-next.2; 17.0.0-next.0 to 18.2.14

Identifiers

  • CVE-2026-32635
  • GHSA-g93w-mfhg-p222

Timeline

  • 2026-03-13: disclosed: GHSA-g93w-mfhg-p222 published
  • 2026-03-13: patched: Patches released: 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.