CVE-2026-32635
CVE-2026-32635 · Angular has XSS in i18n attribute bindings
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
CVSS 8.6 · High · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
compiler
- Versions
- >= 22.0.0-next.0, < 22.0.0-next.3: Affected
- >= 21.0.0-next.0, < 21.2.4: Affected
- >= 20.0.0-next.0, < 20.3.18: Affected
- >= 17.0.0.next.0, < 19.2.20: Affected
No fix published
core
- Versions
- >= 22.0.0-next.0, < 22.0.0-next.3: Affected
- >= 21.0.0-next.0, < 21.2.4: Affected
- >= 20.0.0-next.0, < 20.3.18: Affected
- >= 17.0.0.next.0, < 19.2.20: Affected
No fix published
angular.js Debian:12
- Versions
- 1.8.3-1
- 1.8.3-1+deb12u1
- 1.8.3-1+deb12u1~deb11u1
- 1.8.3-2
- 1.8.3-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Debian:13
- Versions
- 1.8.3-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
@angular/core npm
- Affected ranges
- SEMVER: ≥ 22.0.0-next.0, < 22.0.0-next.3
Update to 22.0.0-next.3
@angular/core npm
- Affected ranges
- SEMVER: ≥ 21.0.0-next.0, < 21.2.4
Update to 21.2.4
@angular/core npm
- Affected ranges
- SEMVER: ≥ 20.0.0-next.0.0.0, < 20.3.18
Update to 20.3.18
@angular/core npm
- Affected ranges
- SEMVER: ≥ 19.0.0-next.0, < 19.2.20
Update to 19.2.20
@angular/core npm
- Affected ranges
- SEMVER: ≥ 17.0.0-next.0, ≤ 18.2.14
No fix published
@angular/compiler npm
- Affected ranges
- SEMVER: ≥ 22.0.0-next.0, < 22.0.0-next.3
Update to 22.0.0-next.3
@angular/compiler npm
- Affected ranges
- SEMVER: ≥ 21.0.0-next.0, < 21.2.4
Update to 21.2.4
@angular/compiler npm
- Affected ranges
- SEMVER: ≥ 20.0.0-next.0.0.0, < 20.3.18
Update to 20.3.18
@angular/compiler npm
- Affected ranges
- SEMVER: ≥ 19.0.0-next.0, < 19.2.20
Update to 19.2.20
@angular/compiler npm
- Affected ranges
- SEMVER: ≥ 17.0.0-next.0, ≤ 18.2.14
No fix published
angular.js Ubuntu:Pro:16.04:LTS
- Versions
- 1.2.28-1ubuntu2
- 1.2.28-1ubuntu2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Ubuntu:Pro:18.04:LTS
- Versions
- 1.5.10-1
- 1.5.10-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Ubuntu:Pro:20.04:LTS
- Versions
- 1.5.10-1
- 1.7.9-1
- 1.7.9-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Ubuntu:22.04:LTS
- Versions
- 1.8.2-2
- 1.8.2-2ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Ubuntu:24.04:LTS
- Versions
- 1.8.3-1
- 1.8.3-1ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Ubuntu:25.10
- Versions
- 1.8.3-1
- 1.8.3-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Ubuntu:26.10
- Versions
- 1.8.3-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
angular.js Ubuntu:26.04:LTS
- Versions
- 1.8.3-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published