Executive brief
Angular is a widely-used web application framework that protects applications against malicious scripts (XSS attacks) by automatically cleaning untrusted data before it's rendered. This vulnerability allows attackers to bypass that protection in specific cases where directives bind data to security-sensitive attributes like href or src. If an attacker can control the data being passed to an affected directive, they can inject malicious JavaScript code that executes in users' browsers, leading to account compromise, data theft, or unauthorized actions.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in Angular's compiler and runtime sanitization. The root cause is that the compiler determines the SecurityContext for directive host bindings (e.g., `@HostBinding('attr.href')` or `host: {'[attr.href]': 'value'}`) based on the declaring directive's selector at compile time, rather than the concrete host element the directive is applied to. This leads to incorrect or missing sanitization when directives are applied to different concrete elements via hostDirectives composition, class inheritance, dynamic component instantiation, SVG/MathML namespaces, or tag-neutral selectors. Untrusted inputs like `javascript:...` URLs bypass the built-in sanitizer and are written to DOM attributes as-is. The attack requires network access and user interaction (passive), and no authentication or special privileges. Patches have been released in versions 22.1.0, 21.2.20, and 20.3.28; version 19.2.25 and earlier lack patches and remain vulnerable.
Affected products
- Google @angular/core 20.0.0–20.3.27, 21.0.0–21.2.19, 22.0.0–22.0.x, <=19.2.25
- Google @angular/compiler 20.0.0–20.3.27, 21.0.0–21.2.19, 22.0.0–22.0.x, <=19.2.25
Timeline
- 2026-09-10: disclosed: GHSA-hh8m-fm6v-7cvg published
- 2026: patched: Patches released in versions 22.1.0, 21.2.20, 20.3.28