p PatchFirst

PatchFirst · Latest vulnerabilities

@angular/core vulnerabilities

Vulnerabilities published for @angular/core in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 9

  1. CVE-2026-88057

    Medium · CVSS 5.3EPSS 0.37%Fix available

    Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements

    @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 20.3.28
    • Update to 21.2.20
    • Update to 22.1.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-69151

    High · CVSS 7.6EPSS 0.33%Fix available

    Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

    @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 20.3.27
    • Update to 21.2.19
    • Update to 22.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-54267

    High · CVSS 8.6EPSS 0.32%Fix available

    Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a <script> tag with a predictable identifier. During client bootstrap, Angular recovers this state by looking up the element via document.getElementById('ng-state') and parsing its text content. Because t

    @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 20.3.25
    • Update to 21.2.17
    • Update to 22.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-52725

    Medium · CVSS 5.3EPSS 0.4%Fix available

    Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 19.2.23
    • Update to 20.3.22
    • Update to 21.2.15
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-50557

    Medium · CVSS 5.3EPSS 0.34%Fix available

    Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attribu

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 19.2.22
    • Update to 20.3.22
    • Update to 21.2.15
    • Update to 22.0.0-rc.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-32635

    High · CVSS 8.6EPSS 0.5%Fix available

    Angular has XSS in i18n attribute bindings

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted us

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 19.2.20
    • Update to 20.3.18
    • Update to 21.2.4
    • Update to 22.0.0-next.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-27970

    High · CVSS 7.6EPSS 0.52%Fix available

    Angular i18n vulnerable to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 19.2.19
    • Update to 20.3.17
    • Update to 21.1.6
    • Update to 21.2.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2026-22610

    High · CVSS 8.5EPSS 0.44%Fix available

    Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

    @angular/core @angular/core @angular/core @angular/core @angular/coreNode.js
    • Update to 19.2.18
    • Update to 20.3.16
    • Update to 21.0.7
    • Update to 21.1.0-rc.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2021-4231

    Low · CVSS 3.5EPSS 1.18%Fix available

    Angular Comment cross site scripting

    A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.

    @angular/core @angular/core @angular/coreNode.js
    • Update to 10.2.5
    • Update to 11.0.5
    • Update to 11.1.0-next.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →