p PatchFirst

CVE-2026-22610

CVE-2026-22610 · Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

CVSS 8.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • angular

    Versions
    • >= 21.1.0-next.0, < 21.1.0-rc.0: Affected
    • >= 21.0.0-next.0, < 21.0.7: Affected
    • >= 20.0.0-next.0, < 20.3.16: Affected
    • < 19.2.18: Affected

    No fix published

  • @angular/compiler npm

    Affected ranges
    • SEMVER: ≥ 21.1.0-next.0, < 21.1.0-rc.0

    Update to 21.1.0-rc.0

  • @angular/core npm

    Affected ranges
    • SEMVER: ≥ 21.1.0-next.0, < 21.1.0-rc.0

    Update to 21.1.0-rc.0

  • @angular/compiler npm

    Affected ranges
    • SEMVER: ≥ 21.0.0-next.0, < 21.0.7

    Update to 21.0.7

  • @angular/core npm

    Affected ranges
    • SEMVER: ≥ 21.0.0-next.0, < 21.0.7

    Update to 21.0.7

  • @angular/compiler npm

    Affected ranges
    • SEMVER: ≥ 20.0.0-next.0, < 20.3.16

    Update to 20.3.16

  • @angular/core npm

    Affected ranges
    • SEMVER: ≥ 20.0.0-next.0, < 20.3.16

    Update to 20.3.16

  • @angular/compiler npm

    Affected ranges
    • SEMVER: ≥ 19.0.0-next.0, < 19.2.18

    Update to 19.2.18

  • @angular/core npm

    Affected ranges
    • SEMVER: ≥ 19.0.0-next.0, < 19.2.18

    Update to 19.2.18

  • @angular/compiler npm

    Affected ranges
    • SEMVER: ≤ 18.2.14

    No fix published

  • @angular/core npm

    Affected ranges
    • SEMVER: ≤ 18.2.14

    No fix published

  • angular.js Ubuntu:Pro:16.04:LTS

    Versions
    • 1.2.28-1ubuntu2
    • 1.2.28-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:Pro:18.04:LTS

    Versions
    • 1.5.10-1
    • 1.5.10-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:Pro:20.04:LTS

    Versions
    • 1.5.10-1
    • 1.7.9-1
    • 1.7.9-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:22.04:LTS

    Versions
    • 1.8.2-2
    • 1.8.2-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:24.04:LTS

    Versions
    • 1.8.3-1
    • 1.8.3-1ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:25.10

    Versions
    • 1.8.3-1
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:26.10

    Versions
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • angular.js Ubuntu:26.04:LTS

    Versions
    • 1.8.3-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →