CVE-2026-69151: Angular i18n Cross-Site Scripting via event-handler attributes

CVE-2026-69151 · Severity: high · CVSS 4 · Published 2026-08-03

Angular, a popular web development framework, has a vulnerability in how it handles website translations. If an attacker can influence the translation files used by an application, they can inject malicious scripts that run when a user visits the site. This could allow the attacker to steal user login sessions, perform unauthorized actions on behalf of users, or access sensitive data.

Technologies: @angular/compiler (npm), @angular/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-69151 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69151 being exploited in the wild.
How severe is CVE-2026-69151?
High severity, with a CVSS score of 4, published 3 August 2026.
Which products and versions are affected?
@angular/compiler (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1; @angular/core (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.1.
Is there a fix for CVE-2026-69151?
Yes. @angular/compiler (npm): upgrade to 22.0.1 or later; @angular/core (npm): upgrade to 22.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69151 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69151?
Check whether you run @angular/compiler (npm) or @angular/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/compiler (npm): upgrade to 22.0.1 or later
    npm install @angular/compiler@22.0.1
  • @angular/core (npm): upgrade to 22.0.1 or later
    npm install @angular/core@22.0.1

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Angular compiler's internationalization (i18n) pipeline. While Angular typically validates and blocks bindings to event-handler attributes like 'onclick' or 'onerror', the i18n metadata collection path failed to apply these restrictions to 'i18n-on*' attributes. An attacker who can influence the content of translation files can replace benign static handlers with arbitrary JavaScript. This code is then executed in the context of the application's domain during the localized build process. The vulnerability is patched in versions 22.0.1, 21.2.19, and 20.3.27.

Affected products

  • Angular @angular/compiler >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25
  • Angular @angular/core >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25

Identifiers

  • CVE-2026-69151
  • GHSA-jj27-h5hq-8x99

Timeline

  • 2026-07-29: disclosed: Initial disclosure by alan-agius4
  • 2026-08-03: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.