p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in @angular/core

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für @angular/core: 0. Davon im KEV-Katalog: 0.

RSS ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 9

  1. CVE-2026-88057

    Mittel · CVSS 5.3EPSS 0,37%Korrektur verfügbar

    Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements

    @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 20.3.28 aktualisieren
    • Auf 21.2.20 aktualisieren
    • Auf 22.1.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-69151

    Hoch · CVSS 7.6EPSS 0,33%Korrektur verfügbar

    Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

    @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 20.3.27 aktualisieren
    • Auf 21.2.19 aktualisieren
    • Auf 22.0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-54267

    Hoch · CVSS 8.6EPSS 0,32%Korrektur verfügbar

    Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a <script> tag with a predictable identifier. During client bootstrap, Angular recovers this state by looking up the element via document.getElementById('ng-state') and parsing its text content. Because t

    @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 20.3.25 aktualisieren
    • Auf 21.2.17 aktualisieren
    • Auf 22.0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-52725

    Mittel · CVSS 5.3EPSS 0,4%Korrektur verfügbar

    Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 19.2.23 aktualisieren
    • Auf 20.3.22 aktualisieren
    • Auf 21.2.15 aktualisieren
    • Auf 22.0.0-rc.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-50557

    Mittel · CVSS 5.3EPSS 0,34%Korrektur verfügbar

    Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attribu

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 19.2.22 aktualisieren
    • Auf 20.3.22 aktualisieren
    • Auf 21.2.15 aktualisieren
    • Auf 22.0.0-rc.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-32635

    Hoch · CVSS 8.6EPSS 0,5%Korrektur verfügbar

    Angular has XSS in i18n attribute bindings

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted us

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 19.2.20 aktualisieren
    • Auf 20.3.18 aktualisieren
    • Auf 21.2.4 aktualisieren
    • Auf 22.0.0-next.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-27970

    Hoch · CVSS 7.6EPSS 0,52%Korrektur verfügbar

    Angular i18n vulnerable to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 19.2.19 aktualisieren
    • Auf 20.3.17 aktualisieren
    • Auf 21.1.6 aktualisieren
    • Auf 21.2.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-22610

    Hoch · CVSS 8.5EPSS 0,44%Korrektur verfügbar

    Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Auf 19.2.18 aktualisieren
    • Auf 20.3.16 aktualisieren
    • Auf 21.0.7 aktualisieren
    • Auf 21.1.0-rc.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2021-4231

    Niedrig · CVSS 3.5EPSS 1,18%Korrektur verfügbar

    Angular Comment cross site scripting

    A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.

    @angular/core @angular/core @angular/coreNode.js
    • Auf 10.2.5 aktualisieren
    • Auf 11.0.5 aktualisieren
    • Auf 11.1.0-next.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →