Update dependency @angular/core to v19.2.23 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/core (source)	19.2.0 → 19.2.23

---

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.

In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.

When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.

Impact

When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:

• Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
• Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
• Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.

Attack Preconditions

1. The victim application must explicitly use SVG <script> elements within its templates.
2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).

Patches

• 19.2.18
• 20.3.16
• 21.0.7
• 21.1.0-rc.0

Workarounds

Until the patch is applied, developers should:

• Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
• Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.

Resources

• https://github.com/angular/angular/pull/66318

Severity

• CVSS Score: 8.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6
• https://github.com/angular/angular/pull/66318
• https://nvd.nist.gov/vuln/detail/CVE-2026-22610
• https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html
• https://cert-portal.siemens.com/productcert/html/ssa-485750.html
• https://github.com/advisories/GHSA-jrmj-c5cx-3cw6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Angular i18n vulnerable to Cross-Site Scripting

CVE-2026-27970 / GHSA-prjf-86w9-mfqv

More information

Details

A Cross-site Scripting (XSS) vulnerability has been identified in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript.

Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user.

If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript.

Impact

When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to:

• Credential Exfiltration: Stealing sensitive user data stored in page memory, LocalStorage, IndexedDB, or cookies available to JS and sending them to an attacker controlled server.
• Page Vandalism: Mutating the page to read or act differently than intended by the developer.

Attach Preconditions

• The attacker must compromise the translation file (xliff, xtb, etc.).
• Unlike most XSS vulnerabilities, this one is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client.
• The victim application must use Angular i18n.
• The victim application must use one or more ICU messages.
• The victim application must render an ICU message.
• The victim application must not defend against XSS via a safe Content-Security Policy (CSP) or Trusted Types.

Patches

• 21.2.0
• 21.1.6
• 20.3.17
• 19.2.19

Workarounds

Until the patch is applied, developers should consider:

• Reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application.
• Enabling strict CSP controls to block unauthorized JavaScript from executing on the page.
• Enabling Trusted Types to enforce proper HTML sanitization.

References

• Fix

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv
• https://nvd.nist.gov/vuln/detail/CVE-2026-27970
• https://github.com/angular/angular/pull/67183
• https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d
• https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232
• https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93
• https://angular.dev/best-practices/security#enforcing-trusted-types
• https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
• https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS
• https://github.com/advisories/GHSA-prjf-86w9-mfqv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Angular vulnerable to XSS in i18n attribute bindings

CVE-2026-32635 / GHSA-g93w-mfhg-p222

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.

The following example illustrates the issue:

<ahref="" i18n-href>Click me</a>

The following attributes have been confirmed to be vulnerable:

• action
• background
• cite
• codebase
• data
• formaction
• href
• itemtype
• longdesc
• poster
• src
• xlink:href

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

• Session Hijacking: Stealing session cookies and authentication tokens.
• Data Exfiltration: Capturing and transmitting sensitive user data.
• Unauthorized Actions: Performing actions on behalf of the user.

Attack Preconditions

1. The application must use a vulnerable version of Angular.
2. The application must bind unsanitized user input to one of the attributes mentioned above.
3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.

Patches

• 22.0.0-next.3
• 21.2.4
• 20.3.18
• 19.2.20

Workarounds

The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.

Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:

import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}

References

• Fix 1
• Fix 2

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222
• https://github.com/angular/angular/pull/67541
• https://github.com/angular/angular/pull/67561
• https://github.com/angular/angular/commit/224e60ecb1b90115baa702f1c06edc1d64d86187
• https://github.com/angular/angular/commit/78dea55351fb305b33a919c43a6b363137eca166
• https://github.com/angular/angular/commit/8630319f74c9575a21693d875cc7d5252516146d
• https://github.com/angular/angular/commit/ed2d324f9cc12aab6cfa0569ef10b73243a62c65
• https://nvd.nist.gov/vuln/detail/CVE-2026-32635
• https://github.com/advisories/GHSA-g93w-mfhg-p222

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

CVE-2026-52725 / GHSA-692r-grfm-v8x7

More information

Details

An issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation.

Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts.

This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that registers dynamic components based on user-supplied parameters (like selectors or host elements) is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to mount a dynamic component on a script tag, bypassing core dynamic component creation safeguards to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:

1. User-Controlled Host Selection: The application must accept user-controlled inputs that are passed as a selector/host element to createComponent.
2. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the dynamic creation APIs.

Patches

• 22.0.0-rc.2
• 21.2.15
• 20.3.22
• 19.2.23

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-692r-grfm-v8x7
• https://github.com/angular/angular/pull/68686
• https://github.com/angular/angular/pull/68713
• https://nvd.nist.gov/vuln/detail/CVE-2026-52725
• https://github.com/advisories/GHSA-692r-grfm-v8x7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

CVE-2026-50557 / GHSA-f3m7-gqxr-g87x

More information

Details

An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.

Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.

Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.

Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:

1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.

Patches

• 22.0.0-rc.2
• 21.2.15
• 20.3.22
• 19.2.23

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x
• https://github.com/angular/angular/pull/68689
• https://github.com/angular/angular/pull/68868
• https://nvd.nist.gov/vuln/detail/CVE-2026-50557
• https://github.com/advisories/GHSA-f3m7-gqxr-g87x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/core)

v19.2.23

Compare Source

common

Commit	Type	Description
62dd27d6af	fix	add upper bounds for digitsInfo
17326725ba	fix	sanitize placeholder

compiler

Commit	Type	Description
932e0728db	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry
2e3d0371ab	fix	sanitize dynamic href and xlink:href bindings on SVG a elements
fe1207e8c5	fix	strip namespaced SVG script elements during template compilation

core

Commit	Type	Description
c6bb0692e2	fix	reject script element as a dynamic component host
3960b21558	fix	sanitize meta selectors
3632fa4b69	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
620230dac4	fix	synchronize core sanitization schema with compiler
d31f84116c	fix	wrap i18n dynamic element property updates in active index states

http

Commit	Type	Description
9940ffd781	fix	exclude withCredentials requests from transfer cache
0f67f0b962	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
d187e8aeda	fix	normalize path parsing in ServerPlatformLocation
c75f60ef8a	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
37ee9ffd9e	fix	preserve redirect policy on reconstructed asset requests
97f796203f	fix	Preserves explicit 'credentials: omit' in asset requests
5619120931	fix	Preserves HTTP cache mode in asset group requests

v19.2.22

Compare Source

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#​68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#​68469)

v19.2.21

Compare Source

platform-server

Commit	Type	Description
f3a5bfb949	fix	prevent SSRF bypasses via protocol-relative and backslash URLs

v19.2.20

Compare Source

compiler

Commit	Type	Description
5be912eb55	fix	disallow translations of iframe src

core

Commit	Type	Description
b89b0a83a4	fix	sanitize translated attribute bindings with interpolations
621c7071ad	fix	sanitize translated form attributes

v19.2.19

Compare Source

Breaking Changes

core

• Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

  (cherry picked from commit 03da204)

core

Commit	Type	Description
747548721d	fix	block creation of sensitive URI attributes from ICU messages

v19.2.18

Compare Source

core

Commit	Type	Description
26cdc53d9c	fix	sanitize sensitive attributes on SVG script elements

v19.2.17

Compare Source

compiler

Commit	Type	Description
7c42e2ebeb	fix	prevent XSS via SVG animation attributeName and MathML/SVG URLs

v19.2.16

Compare Source

http

Commit	Type	Description
05fe6686a9	fix	prevent XSRF token leakage to protocol-relative URLs

v19.2.15

Compare Source

Breaking Changes

core

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  constbootstrap=()=>bootstrapApplication(AppComponent,config);

  After:

  constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);

  A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

  In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

core

Commit	Type	Description
70d0639bc1	fix	introduce BootstrapContext for improved server bootstrapping (#​63639)

v19.2.14

Compare Source

compiler

Commit	Type	Description
24bab55f0c	fix	lexer support for template literals in object literals (#​61601)

migrations

Commit	Type	Description
9e1cd49662	fix	preserve comments when removing unused imports (#​61674)

v19.2.13

Compare Source

common

Commit	Type	Description
2c876b4fc5	fix	avoid injecting ApplicationRef in FetchBackend (#​61649)

service-worker

Commit	Type	Description
b15bddfa04	fix	do not register service worker if app is destroyed before it is ready to register (#​61101)

v19.2.12

Compare Source

common

Commit	Type	Description
126efc9972	fix	cancel reader when app is destroyed (#​61528)
efda872453	fix	prevent reading chunks if app is destroyed (#​61354)

compiler

Commit	Type	Description
44bb328eae	fix	avoid conflicts between HMR code and local symbols (#​61550)

compiler-cli

Commit	Type	Description
107180260f	fix	Always retain prior results for all files (#​61487)
1191e62d70	fix	avoid ECMAScript private field metadata emit (#​61227)

core

Commit	Type	Description
2b1b14f4d3	fix	cleanup rxResource abort listener (#​58306)
8f9b05eaaa	fix	cleanup testability subscriptions (#​61261)
eb53bda470	fix	enable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6	fix	Testing should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abc	fix	unregister onDestroy in toSignal. (#​61514)

platform-server

Commit	Type	Description
8edafd0559	perf	speed up resolution of base (#​61392)

v19.2.11

Compare Source

v19.2.10

Compare Source

common

Commit	Type	Description
89056a0356	fix	cleanup updateLatestValue if view is destroyed before promise resolves (#​61064)

core

Commit	Type	Description
4623b61448	fix	missing useExisting providers throwing for optional calls (#​61152)
400dbc5b89	fix	properly handle app stabilization with defer blocks (#​61056)

platform-server

Commit	Type	Description
a6f0d5bc20	fix	less aggressive ngServerMode cleanup (#​61106)

v19.2.9

Compare Source

core

Commit	Type	Description
946b844e0d	fix	async EventEmitter error should not prevent stability (#​61028)
dbb87026ca	fix	call DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136a	fix	prevent stash listener conflicts [patch] (#​61063)

v19.2.8

Compare Source

forms

Commit	Type	Description
ea4a211216	fix	make NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)

v19.2.7

Compare Source

common

Commit	Type	Description
37ab6814f5	fix	issue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)

core

Commit	Type	Description
b144126612	fix	inject migration: replace param with this. (#​60713)

http

Commit	Type	Description
d39e09da41	fix	Include HTTP status code and headers when HTTP requests errored in httpResource (#​60802)

v19.2.6

Compare Source

compiler

Commit	Type	Description
3441f7b914	fix	error if rawText isn't estimated correctly (#​60529) (#​60753)

compiler-cli

Commit	Type	Description
fc946c5f72	fix	ensure HMR works with different output module type (#​60797)

core

Commit	Type	Description
00bbd9b382	fix	fix docs for output migration (#​60764)
f2bfa3151e	fix	fix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0	fix	reduce total memory usage of various migration schematics (#​60776)

language-service

Commit	Type	Description
0e82d42774	fix	Do not provide element completions in end tag (#​60616)
fcdef1019f	fix	Ensure dollar signs are escaped in completions (#​60597)

v19.2.5

Compare Source

Commit	Type	Description
e61d06afb5	fix	step 6 tutorial docs (#​60630)

animations

| Commit

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.