# CVE-2026-32635: Angular XSS in i18n attribute bindings

Source: https://junglewise.ai/threats/cve-2026-32635-angular-xss-in-i18n-attribute-bindings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32635 · Severity: low · CVSS 3.1 · Published 2026-03-13

Angular, a popular JavaScript framework for building web applications, contains a cross-site scripting (XSS) vulnerability in its internationalization (i18n) feature. When developers mark security-sensitive HTML attributes (like href, src, or action) for internationalization and bind them to user-supplied data, Angular's built-in sanitization is bypassed, allowing attackers to inject malicious scripts. This can lead to session hijacking, data theft, and unauthorized actions on behalf of users.

Technologies: [@angular/compiler (npm)](https://junglewise.ai/threats/technologies/angular-compiler), [@angular/core (npm)](https://junglewise.ai/threats/technologies/angular-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-32635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32635 being exploited in the wild.

**How severe is CVE-2026-32635?** Low severity, with a CVSS score of 3.1, published 13 March 2026.

**Which products and versions are affected?** @angular/compiler (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.3; @angular/core (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.0-next.3.

**Is there a fix for CVE-2026-32635?** Yes. @angular/compiler (npm): upgrade to 22.0.0-next.3 or later; @angular/core (npm): upgrade to 22.0.0-next.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32635 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-32635?** Check whether you run @angular/compiler (npm) or @angular/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/compiler (npm): upgrade to 22.0.0-next.3 or later

  ```sh
  npm install @angular/compiler@22.0.0-next.3
  ```

- @angular/core (npm): upgrade to 22.0.0-next.3 or later

  ```sh
  npm install @angular/core@22.0.0-next.3
  ```


## Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in Angular's runtime and compiler. The root cause is that Angular's sanitization mechanism is bypassed when a security-sensitive attribute (href, src, action, etc.) is marked for internationalization via the i18n-<attribute> directive and bound to data using template expressions (e.g., {{maliciousUrl}}). An attacker exploits this by injecting malicious URLs or JavaScript code into untrusted sources (user input, API responses) that flow into these attributes. The attack vector is network-based and requires the application to use a vulnerable Angular version while binding unsanitized user input to a marked attribute. Patches are available in Angular versions 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20; older versions (17.x–18.2.14) are unpatched.

## Affected products

- Google Angular 19.0.0-next.0 to 19.2.19; 20.0.0-next.0 to 20.3.17; 21.0.0-next.0 to 21.2.3; 22.0.0-next.0 to 22.0.0-next.2; 17.0.0-next.0 to 18.2.14

## Identifiers

- CVE-2026-32635
- GHSA-g93w-mfhg-p222

## Timeline

- 2026-03-13: disclosed: GHSA-g93w-mfhg-p222 published
- 2026-03-13: patched: Patches released: 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20

## References

- [https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222](https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222)

## Related threats

- [Angular sanitization bypass in directive host bindings](https://junglewise.ai/threats/cve-2026-88057-angular-sanitization-bypass-in-directive-host-bindings)
- [Angular i18n Cross-Site Scripting via event-handler attributes](https://junglewise.ai/threats/cve-2026-69151-angular-i18n-cross-site-scripting-via-event-handler-attributes)
- [Google Angular DOM Clobbering in Client Hydration](https://junglewise.ai/threats/cve-2026-54267-google-angular-dom-clobbering-in-client-hydration)
- [Google Angular XSS via two-way property binding bypass in @angular/compiler](https://junglewise.ai/threats/cve-2026-54265-google-angular-xss-via-two-way-property-binding-bypass-in-angular)
- [Angular XSS via dynamic component mounting on script elements](https://junglewise.ai/threats/cve-2026-52725-angular-xss-via-dynamic-component-mounting-on-script-elements)