Executive brief
Angular, a popular web development framework, has a vulnerability in how it handles website translations. If an attacker can influence the translation files used by an application, they can inject malicious scripts that run when a user visits the site. This could allow the attacker to steal user login sessions, perform unauthorized actions on behalf of users, or access sensitive data.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Angular compiler's internationalization (i18n) pipeline. While Angular typically validates and blocks bindings to event-handler attributes like 'onclick' or 'onerror', the i18n metadata collection path failed to apply these restrictions to 'i18n-on*' attributes. An attacker who can influence the content of translation files can replace benign static handlers with arbitrary JavaScript. This code is then executed in the context of the application's domain during the localized build process. The vulnerability is patched in versions 22.0.1, 21.2.19, and 20.3.27.
Affected products
- Angular @angular/compiler >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25
- Angular @angular/core >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25
Timeline
- 2026-07-29: disclosed: Initial disclosure by alan-agius4
- 2026-08-03: advisory: GitHub Advisory published