CVE-2026-54265: Google Angular XSS via two-way property binding bypass in @angular/compiler

CVE-2026-54265 · Severity: medium · CVSS 3.1 · Published 2026-06-22

Angular's template compiler fails to sanitize dangerous HTML and URL properties when developers use two-way data binding syntax (instead of one-way binding). This creates a cross-site scripting (XSS) vulnerability where an attacker can inject malicious scripts if the application accepts user input for these sensitive properties. Any Angular application using two-way binding on properties like innerHTML, image src, or link href is at risk of account takeover, data theft, or malware infection.

Technologies: Google Compiler, @angular/compiler (npm). Vendors: Google, npm.

Quick answers

Is CVE-2026-54265 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54265 being exploited in the wild.
How severe is CVE-2026-54265?
Medium severity, with a CVSS score of 3.1, published 22 June 2026.
Which products and versions are affected?
Google Compiler >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25; @angular/compiler (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.
Is there a fix for CVE-2026-54265?
Yes. @angular/compiler (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54265 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54265?
Check whether you run Google Compiler or @angular/compiler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/compiler (npm): upgrade to 22.0.1 or later
    npm install @angular/compiler@22.0.1

Technical details

The vulnerability exists in @angular/compiler's template compilation logic for TwoWayProperty operations. When native DOM properties that require sanitization (innerHTML, srcdoc, src, href, data, sandbox) are bound using two-way binding syntax ([(prop)]="value" or bindon-prop="value"), the compiler fails to apply the schema-derived sanitizer resolution that would normally be applied to equivalent one-way bindings. An attacker who can control the value of a two-way-bound sensitive property can bypass Angular's DomSanitizer, enabling XSS execution in the victim's browser. Exploitation requires the application to use two-way binding on a sensitive property and pass user-controlled input without separate manual sanitization. The fix applies proper sanitizer resolution to TwoWayProperty operations during compilation.

Affected products

  • Angular @angular/compiler 20.0.0 to 20.3.24; 21.0.0 to 21.2.16; 22.0.0 to 22.0.0; all versions prior to 20.0.0 through 19.2.25

Identifiers

  • CVE-2026-54265
  • GHSA-58w9-8g37-x9v5

Timeline

  • 2026-06-15: disclosed: Advisory published; patched versions 22.0.1, 21.2.17, 20.3.25 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.