# CVE-2026-54265: Google Angular XSS via two-way property binding bypass in @angular/compiler

Source: https://junglewise.ai/threats/cve-2026-54265-google-angular-xss-via-two-way-property-binding-bypass-in-angular  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54265 · Severity: medium · CVSS 3.1 · Published 2026-06-22

Angular's template compiler fails to sanitize dangerous HTML and URL properties when developers use two-way data binding syntax (instead of one-way binding). This creates a cross-site scripting (XSS) vulnerability where an attacker can inject malicious scripts if the application accepts user input for these sensitive properties. Any Angular application using two-way binding on properties like innerHTML, image src, or link href is at risk of account takeover, data theft, or malware infection.

Technologies: [Google Compiler](https://junglewise.ai/threats/technologies/compiler), [@angular/compiler (npm)](https://junglewise.ai/threats/technologies/angular-compiler). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54265 being exploited in the wild.

**How severe is CVE-2026-54265?** Medium severity, with a CVSS score of 3.1, published 22 June 2026.

**Which products and versions are affected?** Google Compiler >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.17; >= 20.0.0-next.0, < 20.3.25; <= 19.2.25; @angular/compiler (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.

**Is there a fix for CVE-2026-54265?** Yes. @angular/compiler (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54265 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54265?** Check whether you run Google Compiler or @angular/compiler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/compiler (npm): upgrade to 22.0.1 or later

  ```sh
  npm install @angular/compiler@22.0.1
  ```


## Technical details

The vulnerability exists in @angular/compiler's template compilation logic for TwoWayProperty operations. When native DOM properties that require sanitization (innerHTML, srcdoc, src, href, data, sandbox) are bound using two-way binding syntax ([(prop)]="value" or bindon-prop="value"), the compiler fails to apply the schema-derived sanitizer resolution that would normally be applied to equivalent one-way bindings. An attacker who can control the value of a two-way-bound sensitive property can bypass Angular's DomSanitizer, enabling XSS execution in the victim's browser. Exploitation requires the application to use two-way binding on a sensitive property and pass user-controlled input without separate manual sanitization. The fix applies proper sanitizer resolution to TwoWayProperty operations during compilation.

## Affected products

- Angular @angular/compiler 20.0.0 to 20.3.24; 21.0.0 to 21.2.16; 22.0.0 to 22.0.0; all versions prior to 20.0.0 through 19.2.25

## Identifiers

- CVE-2026-54265
- GHSA-58w9-8g37-x9v5

## Timeline

- 2026-06-15: disclosed: Advisory published; patched versions 22.0.1, 21.2.17, 20.3.25 released

## References

- [https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5](https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5)
- [https://github.com/angular/angular/pull/69107](https://github.com/angular/angular/pull/69107)
- [https://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4](https://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4)
- [https://github.com/angular/angular](https://github.com/angular/angular)

## Related threats

- [Angular sanitization bypass in directive host bindings](https://junglewise.ai/threats/cve-2026-88057-angular-sanitization-bypass-in-directive-host-bindings)
- [Angular i18n Cross-Site Scripting via event-handler attributes](https://junglewise.ai/threats/cve-2026-69151-angular-i18n-cross-site-scripting-via-event-handler-attributes)
- [Google Angular XSS bypass via namespaced elements and attributes](https://junglewise.ai/threats/cve-2026-50557-google-angular-xss-bypass-via-namespaced-elements-and-attributes)
- [Angular XSS in i18n attribute bindings](https://junglewise.ai/threats/cve-2026-32635-angular-xss-in-i18n-attribute-bindings)
- [Google Angular XSS in SVG script element attributes](https://junglewise.ai/threats/cve-2026-22610-google-angular-xss-in-svg-script-element-attributes)