Executive brief
Angular is a popular framework used to build web and mobile applications. A security flaw in how it handles certain code tags (like SVG or MathML) could allow an attacker to bypass built-in security filters. If an application processes user-provided content through the Angular compiler, an attacker could execute malicious scripts in a victim's browser, potentially leading to account takeover or the theft of sensitive information.
Technical details
A vulnerability exists in the @angular/compiler and @angular/core packages where the template preparser fails to correctly identify and strip namespaced script elements (e.g., <svg:script>). Additionally, security context schema mappings for attributes within namespaced elements like SVG and MathML were inconsistent, allowing malicious attributes to bypass both runtime and compile-time sanitizers. An attacker can exploit this by providing a crafted template structure using custom namespaces. This bypasses Angular's script-stripping logic and attribute sanitization, resulting in client-side Cross-Site Scripting (XSS). The vulnerability primarily affects applications that compile user-controlled templates at runtime. Patches are available in versions 19.2.22, 20.3.22, 21.2.15, and 22.0.0-rc.2.
Affected products
- Google Angular < 19.2.22, >= 19.0.0-next.0 < 19.2.22, >= 20.0.0-next.0 < 20.3.22, >= 21.0.0-next.0 < 21.2.15, >= 22.0.0-next.0 < 22.0.0-rc.2
Timeline
- 2026-05-12: other: Initial pull request for SVG script stripping submitted
- 2026-06-05: advisory: GitHub Security Advisory GHSA-f3m7-gqxr-g87x published
- 2026-06-22: disclosed: CVE-2026-50557 published to NVD