Executive brief
Angular, a popular JavaScript framework for building web applications, contains a cross-site scripting (XSS) vulnerability in its internationalization (i18n) feature. When developers mark security-sensitive HTML attributes (like href, src, or action) for internationalization and bind them to user-supplied data, Angular's built-in sanitization is bypassed, allowing attackers to inject malicious scripts. This can lead to session hijacking, data theft, and unauthorized actions on behalf of users.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in Angular's runtime and compiler. The root cause is that Angular's sanitization mechanism is bypassed when a security-sensitive attribute (href, src, action, etc.) is marked for internationalization via the i18n-<attribute> directive and bound to data using template expressions (e.g., {{maliciousUrl}}). An attacker exploits this by injecting malicious URLs or JavaScript code into untrusted sources (user input, API responses) that flow into these attributes. The attack vector is network-based and requires the application to use a vulnerable Angular version while binding unsanitized user input to a marked attribute. Patches are available in Angular versions 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20; older versions (17.x–18.2.14) are unpatched.
Affected products
- Google Angular 19.0.0-next.0 to 19.2.19; 20.0.0-next.0 to 20.3.17; 21.0.0-next.0 to 21.2.3; 22.0.0-next.0 to 22.0.0-next.2; 17.0.0-next.0 to 18.2.14
Timeline
- 2026-03-13: disclosed: GHSA-g93w-mfhg-p222 published
- 2026-03-13: patched: Patches released: 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20