Skip to content

Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-angular-compiler-vulnerability
Open

Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-angular-compiler-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Dec 2, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

CVE-2025-66412 / GHSA-v4hv-rgfq-gp49

More information

Details

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.

Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.

Attributes confirmed to be vulnerable include:

  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".

When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds

If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).

  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.

Severity

  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.

In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.

When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.

Impact

When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:

  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds

Until the patch is applied, developers should:

  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources

Severity

  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular vulnerable to XSS in i18n attribute bindings

CVE-2026-32635 / GHSA-g93w-mfhg-p222

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.

The following example illustrates the issue:

<ahref="" i18n-href>Click me</a>

The following attributes have been confirmed to be vulnerable:

  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds

The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.

Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:

import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References

Severity

  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

CVE-2026-50557 / GHSA-f3m7-gqxr-g87x

More information

Details

An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.

Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.

Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.

Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:

  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@​angular/compiler)

v19.2.22

Compare Source

core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)

v19.2.21

Compare Source

platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs

v19.2.20

Compare Source

compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes

v19.2.19

Compare Source

Breaking Changes

core

  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

    (cherry picked from commit 03da204)

core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages

v19.2.18

Compare Source

core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements

v19.2.17

Compare Source

compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs

v19.2.16

Compare Source

http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs

v19.2.15

Compare Source

Breaking Changes

core

  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

    Before:

    constbootstrap=()=>bootstrapApplication(AppComponent,config);

    After:

    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);

    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)

v19.2.14

Compare Source

compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)

v19.2.13

Compare Source

common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)

v19.2.12

Compare Source

common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)

v19.2.11

Compare Source

v19.2.10

Compare Source

common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)

v19.2.9

Compare Source

core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)

v19.2.8

Compare Source

forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)

v19.2.7

Compare Source

common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)

v19.2.6

Compare Source

compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)

v19.2.5

Compare Source

CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)

v19.2.4

Compare Source

core

| Commit

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

kodiakhq[bot]
kodiakhqBot approved these changes Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed the renovate/npm-angular-compiler-vulnerability branch from df3da4f to d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot changed the title Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed the renovate/npm-angular-compiler-vulnerability branch from d8615d9 to b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot changed the title Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot changed the title Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot closed this Mar 27, 2026
@renovate
renovateBot deleted the renovate/npm-angular-compiler-vulnerability branch March 27, 2026 02:13
@renovaterenovateBot changed the title Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot reopened this Mar 30, 2026
@renovate
renovateBotforce-pushed the renovate/npm-angular-compiler-vulnerability branch 2 times, most recently from b334b69 to 2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot changed the title Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot closed this Apr 27, 2026
@renovaterenovateBot changed the title Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot reopened this Apr 27, 2026
@renovate
renovateBotforce-pushed the renovate/npm-angular-compiler-vulnerability branch 2 times, most recently from 2e02d02 to f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot changed the title Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed the renovate/npm-angular-compiler-vulnerability branch from f16f107 to 964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Update dependency @angular/compiler to v19.2.22 [SECURITY] by renovate[bot] · Pull Request #765 · esm-bundle/angular__common · GitHub
Skip to content
Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Open
Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
CVE-2025-66412 / GHSA-v4hv-rgfq-gp49
More information
Details
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular vulnerable to XSS in i18n attribute bindings
CVE-2026-32635 / GHSA-g93w-mfhg-p222
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.
The following example illustrates the issue:
<ahref="" i18n-href>Click me</a>
The following attributes have been confirmed to be vulnerable:
  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.
Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:
import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References
Severity
  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-50557 / GHSA-f3m7-gqxr-g87x
More information
Details
An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.
Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.
Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.
Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).
Impact
Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.
Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.
Attack Preconditions
To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:
  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23
Severity
  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@​angular/compiler)
v19.2.22
Compare Source
core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)
v19.2.21
Compare Source
platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs
v19.2.20
Compare Source
compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes
v19.2.19
Compare Source
Breaking Changes
core
  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
    (cherry picked from commit 03da204)
core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages
v19.2.18
Compare Source
core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements
v19.2.17
Compare Source
compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs
v19.2.16
Compare Source
http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs
v19.2.15
Compare Source
Breaking Changes
core
  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
    Before:
    constbootstrap=()=>bootstrapApplication(AppComponent,config);
    After:
    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);
    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)
v19.2.14
Compare Source
compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)
v19.2.13
Compare Source
common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)
v19.2.12
Compare Source
common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)
v19.2.11
Compare Source
v19.2.10
Compare Source
common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)
v19.2.9
Compare Source
core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)
v19.2.8
Compare Source
forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)
v19.2.7
Compare Source
common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)
v19.2.6
Compare Source
compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)
v19.2.5
Compare Source
CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)
v19.2.4
Compare Source
core
| Commit
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
kodiakhq[bot]
kodiakhqBot
approved these changes
Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
df3da4f to
d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
d8615d9 to
b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026
@renovate
renovateBot
deleted the

renovate/npm-angular-compiler-vulnerability

branch
March 27, 2026 02:13
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
b334b69 to
2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
2e02d02 to
f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
f16f107 to
964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency @angular/compiler to v19.2.22 [SECURITY] by renovate[bot] · Pull Request #765 · esm-bundle/angular__common · GitHub
Skip to content
Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Open
Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
CVE-2025-66412 / GHSA-v4hv-rgfq-gp49
More information
Details
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular vulnerable to XSS in i18n attribute bindings
CVE-2026-32635 / GHSA-g93w-mfhg-p222
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.
The following example illustrates the issue:
<ahref="" i18n-href>Click me</a>
The following attributes have been confirmed to be vulnerable:
  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.
Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:
import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References
Severity
  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-50557 / GHSA-f3m7-gqxr-g87x
More information
Details
An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.
Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.
Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.
Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).
Impact
Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.
Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.
Attack Preconditions
To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:
  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23
Severity
  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@​angular/compiler)
v19.2.22
Compare Source
core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)
v19.2.21
Compare Source
platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs
v19.2.20
Compare Source
compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes
v19.2.19
Compare Source
Breaking Changes
core
  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
    (cherry picked from commit 03da204)
core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages
v19.2.18
Compare Source
core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements
v19.2.17
Compare Source
compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs
v19.2.16
Compare Source
http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs
v19.2.15
Compare Source
Breaking Changes
core
  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
    Before:
    constbootstrap=()=>bootstrapApplication(AppComponent,config);
    After:
    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);
    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)
v19.2.14
Compare Source
compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)
v19.2.13
Compare Source
common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)
v19.2.12
Compare Source
common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)
v19.2.11
Compare Source
v19.2.10
Compare Source
common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)
v19.2.9
Compare Source
core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)
v19.2.8
Compare Source
forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)
v19.2.7
Compare Source
common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)
v19.2.6
Compare Source
compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)
v19.2.5
Compare Source
CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)
v19.2.4
Compare Source
core
| Commit
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
kodiakhq[bot]
kodiakhqBot
approved these changes
Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
df3da4f to
d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
d8615d9 to
b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026
@renovate
renovateBot
deleted the

renovate/npm-angular-compiler-vulnerability

branch
March 27, 2026 02:13
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
b334b69 to
2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
2e02d02 to
f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
f16f107 to
964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency @angular/compiler to v19.2.22 [SECURITY] by renovate[bot] · Pull Request #765 · esm-bundle/angular__common · GitHub
Skip to content
Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Open
Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
CVE-2025-66412 / GHSA-v4hv-rgfq-gp49
More information
Details
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular vulnerable to XSS in i18n attribute bindings
CVE-2026-32635 / GHSA-g93w-mfhg-p222
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.
The following example illustrates the issue:
<ahref="" i18n-href>Click me</a>
The following attributes have been confirmed to be vulnerable:
  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.
Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:
import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References
Severity
  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-50557 / GHSA-f3m7-gqxr-g87x
More information
Details
An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.
Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.
Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.
Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).
Impact
Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.
Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.
Attack Preconditions
To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:
  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23
Severity
  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@​angular/compiler)
v19.2.22
Compare Source
core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)
v19.2.21
Compare Source
platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs
v19.2.20
Compare Source
compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes
v19.2.19
Compare Source
Breaking Changes
core
  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
    (cherry picked from commit 03da204)
core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages
v19.2.18
Compare Source
core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements
v19.2.17
Compare Source
compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs
v19.2.16
Compare Source
http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs
v19.2.15
Compare Source
Breaking Changes
core
  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
    Before:
    constbootstrap=()=>bootstrapApplication(AppComponent,config);
    After:
    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);
    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)
v19.2.14
Compare Source
compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)
v19.2.13
Compare Source
common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)
v19.2.12
Compare Source
common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)
v19.2.11
Compare Source
v19.2.10
Compare Source
common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)
v19.2.9
Compare Source
core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)
v19.2.8
Compare Source
forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)
v19.2.7
Compare Source
common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)
v19.2.6
Compare Source
compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)
v19.2.5
Compare Source
CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)
v19.2.4
Compare Source
core
| Commit
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
kodiakhq[bot]
kodiakhqBot
approved these changes
Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
df3da4f to
d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
d8615d9 to
b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026
@renovate
renovateBot
deleted the

renovate/npm-angular-compiler-vulnerability

branch
March 27, 2026 02:13
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
b334b69 to
2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
2e02d02 to
f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
f16f107 to
964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Update dependency @angular/compiler to v19.2.22 [SECURITY] by renovate[bot] · Pull Request #765 · esm-bundle/angular__common · GitHub
Skip to content
Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Open
Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
CVE-2025-66412 / GHSA-v4hv-rgfq-gp49
More information
Details
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular vulnerable to XSS in i18n attribute bindings
CVE-2026-32635 / GHSA-g93w-mfhg-p222
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.
The following example illustrates the issue:
<ahref="" i18n-href>Click me</a>
The following attributes have been confirmed to be vulnerable:
  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.
Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:
import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References
Severity
  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-50557 / GHSA-f3m7-gqxr-g87x
More information
Details
An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.
Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.
Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.
Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).
Impact
Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.
Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.
Attack Preconditions
To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:
  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23
Severity
  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@​angular/compiler)
v19.2.22
Compare Source
core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)
v19.2.21
Compare Source
platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs
v19.2.20
Compare Source
compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes
v19.2.19
Compare Source
Breaking Changes
core
  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
    (cherry picked from commit 03da204)
core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages
v19.2.18
Compare Source
core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements
v19.2.17
Compare Source
compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs
v19.2.16
Compare Source
http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs
v19.2.15
Compare Source
Breaking Changes
core
  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
    Before:
    constbootstrap=()=>bootstrapApplication(AppComponent,config);
    After:
    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);
    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)
v19.2.14
Compare Source
compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)
v19.2.13
Compare Source
common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)
v19.2.12
Compare Source
common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)
v19.2.11
Compare Source
v19.2.10
Compare Source
common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)
v19.2.9
Compare Source
core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)
v19.2.8
Compare Source
forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)
v19.2.7
Compare Source
common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)
v19.2.6
Compare Source
compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)
v19.2.5
Compare Source
CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)
v19.2.4
Compare Source
core
| Commit
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
kodiakhq[bot]
kodiakhqBot
approved these changes
Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
df3da4f to
d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
d8615d9 to
b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026
@renovate
renovateBot
deleted the

renovate/npm-angular-compiler-vulnerability

branch
March 27, 2026 02:13
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
b334b69 to
2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
2e02d02 to
f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
f16f107 to
964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency @angular/compiler to v19.2.22 [SECURITY] by renovate[bot] · Pull Request #765 · esm-bundle/angular__common · GitHub
Skip to content
Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Open
Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
CVE-2025-66412 / GHSA-v4hv-rgfq-gp49
More information
Details
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular vulnerable to XSS in i18n attribute bindings
CVE-2026-32635 / GHSA-g93w-mfhg-p222
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.
The following example illustrates the issue:
<ahref="" i18n-href>Click me</a>
The following attributes have been confirmed to be vulnerable:
  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.
Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:
import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References
Severity
  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-50557 / GHSA-f3m7-gqxr-g87x
More information
Details
An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.
Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.
Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.
Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).
Impact
Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.
Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.
Attack Preconditions
To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:
  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23
Severity
  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@​angular/compiler)
v19.2.22
Compare Source
core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)
v19.2.21
Compare Source
platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs
v19.2.20
Compare Source
compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes
v19.2.19
Compare Source
Breaking Changes
core
  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
    (cherry picked from commit 03da204)
core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages
v19.2.18
Compare Source
core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements
v19.2.17
Compare Source
compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs
v19.2.16
Compare Source
http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs
v19.2.15
Compare Source
Breaking Changes
core
  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
    Before:
    constbootstrap=()=>bootstrapApplication(AppComponent,config);
    After:
    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);
    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)
v19.2.14
Compare Source
compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)
v19.2.13
Compare Source
common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)
v19.2.12
Compare Source
common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)
v19.2.11
Compare Source
v19.2.10
Compare Source
common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)
v19.2.9
Compare Source
core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)
v19.2.8
Compare Source
forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)
v19.2.7
Compare Source
common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)
v19.2.6
Compare Source
compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)
v19.2.5
Compare Source
CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)
v19.2.4
Compare Source
core
| Commit
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
kodiakhq[bot]
kodiakhqBot
approved these changes
Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
df3da4f to
d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
d8615d9 to
b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026
@renovate
renovateBot
deleted the

renovate/npm-angular-compiler-vulnerability

branch
March 27, 2026 02:13
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
b334b69 to
2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
2e02d02 to
f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
f16f107 to
964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency @angular/compiler to v19.2.22 [SECURITY] by renovate[bot] · Pull Request #765 · esm-bundle/angular__common · GitHub
Skip to content
Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Open
Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
CVE-2025-66412 / GHSA-v4hv-rgfq-gp49
More information
Details
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular vulnerable to XSS in i18n attribute bindings
CVE-2026-32635 / GHSA-g93w-mfhg-p222
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.
The following example illustrates the issue:
<ahref="" i18n-href>Click me</a>
The following attributes have been confirmed to be vulnerable:
  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.
Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:
import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References
Severity
  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-50557 / GHSA-f3m7-gqxr-g87x
More information
Details
An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.
Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.
Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.
Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).
Impact
Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.
Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.
Attack Preconditions
To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:
  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23
Severity
  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@​angular/compiler)
v19.2.22
Compare Source
core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)
v19.2.21
Compare Source
platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs
v19.2.20
Compare Source
compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes
v19.2.19
Compare Source
Breaking Changes
core
  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
    (cherry picked from commit 03da204)
core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages
v19.2.18
Compare Source
core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements
v19.2.17
Compare Source
compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs
v19.2.16
Compare Source
http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs
v19.2.15
Compare Source
Breaking Changes
core
  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
    Before:
    constbootstrap=()=>bootstrapApplication(AppComponent,config);
    After:
    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);
    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)
v19.2.14
Compare Source
compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)
v19.2.13
Compare Source
common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)
v19.2.12
Compare Source
common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)
v19.2.11
Compare Source
v19.2.10
Compare Source
common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)
v19.2.9
Compare Source
core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)
v19.2.8
Compare Source
forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)
v19.2.7
Compare Source
common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)
v19.2.6
Compare Source
compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)
v19.2.5
Compare Source
CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)
v19.2.4
Compare Source
core
| Commit
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
kodiakhq[bot]
kodiakhqBot
approved these changes
Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
df3da4f to
d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
d8615d9 to
b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026
@renovate
renovateBot
deleted the

renovate/npm-angular-compiler-vulnerability

branch
March 27, 2026 02:13
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
b334b69 to
2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
2e02d02 to
f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
f16f107 to
964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Update dependency @angular/compiler to v19.2.22 [SECURITY] by renovate[bot] · Pull Request #765 · esm-bundle/angular__common · GitHub
Skip to content
Update dependency @angular/compiler to v19.2.22 [SECURITY] - #765
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Open
Update dependency @angular/compiler to v19.2.22 [SECURITY]#765
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-angular-compiler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Dec 2, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
@angular/compiler (source)19.1.7 → 19.2.22ageconfidence
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
CVE-2025-66412 / GHSA-v4hv-rgfq-gp49
More information
Details
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
  • SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
  • SVG animation attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Patches
  • 19.2.17
  • 20.3.15
  • 21.0.2
Attack Preconditions
  • The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
  • The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
  • Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
  • Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
  • Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.
In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.
Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
Attack Preconditions
  1. The victim application must explicitly use SVG <script> elements within its templates.
  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).
Patches
  • 19.2.18
  • 20.3.16
  • 21.0.7
  • 21.1.0-rc.0
Workarounds
Until the patch is applied, developers should:
  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.
Resources
Severity
  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular vulnerable to XSS in i18n attribute bindings
CVE-2026-32635 / GHSA-g93w-mfhg-p222
More information
Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.
The following example illustrates the issue:
<ahref="" i18n-href>Click me</a>
The following attributes have been confirmed to be vulnerable:
  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.
Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:
import{Component,inject,SecurityContext}from'@angular/core';import{DomSanitizer}from'@angular/platform-browser';
@Component({template: ` <form action="" i18n-action> <button>Submit</button> </form> `,})exportclassApp{url: string;constructor(){constdangerousUrl='javascript:alert(1)';constsanitizer=inject(DomSanitizer);this.url=sanitizer.sanitize(SecurityContext.URL,dangerousUrl)||'';}}
References
Severity
  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-50557 / GHSA-f3m7-gqxr-g87x
More information
Details
An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.
Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.
Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.
Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).
Impact
Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.
Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.
Attack Preconditions
To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:
  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23
Severity
  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@​angular/compiler)
v19.2.22
Compare Source
core
CommitTypeDescription
83a640516ffixdisallow event attribute bindings in host bindings unconditionally (#​68469)
24a0103a98fixvalidate security-sensitive attributes in i18n bindings (#​68469)
platform-server
CommitTypeDescription
8569db8875fixadd allowedHosts option to renderModule and renderApplication
837a710217fixensure origin has a trailing slash when parsing url (#​68469)
v19.2.21
Compare Source
platform-server
CommitTypeDescription
f3a5bfb949fixprevent SSRF bypasses via protocol-relative and backslash URLs
v19.2.20
Compare Source
compiler
CommitTypeDescription
5be912eb55fixdisallow translations of iframe src
core
CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes
v19.2.19
Compare Source
Breaking Changes
core
  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
    (cherry picked from commit 03da204)
core
CommitTypeDescription
747548721dfixblock creation of sensitive URI attributes from ICU messages
v19.2.18
Compare Source
core
CommitTypeDescription
26cdc53d9cfixsanitize sensitive attributes on SVG script elements
v19.2.17
Compare Source
compiler
CommitTypeDescription
7c42e2ebebfixprevent XSS via SVG animation attributeName and MathML/SVG URLs
v19.2.16
Compare Source
http
CommitTypeDescription
05fe6686a9fixprevent XSRF token leakage to protocol-relative URLs
v19.2.15
Compare Source
Breaking Changes
core
  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
    Before:
    constbootstrap=()=>bootstrapApplication(AppComponent,config);
    After:
    constbootstrap=(context: BootstrapContext)=>bootstrapApplication(AppComponent,config,context);
    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
core
CommitTypeDescription
70d0639bc1fixintroduce BootstrapContext for improved server bootstrapping (#​63639)
v19.2.14
Compare Source
compiler
CommitTypeDescription
24bab55f0cfixlexer support for template literals in object literals (#​61601)
migrations
CommitTypeDescription
9e1cd49662fixpreserve comments when removing unused imports (#​61674)
v19.2.13
Compare Source
common
CommitTypeDescription
2c876b4fc5fixavoid injecting ApplicationRef in FetchBackend (#​61649)
service-worker
CommitTypeDescription
b15bddfa04fixdo not register service worker if app is destroyed before it is ready to register (#​61101)
v19.2.12
Compare Source
common
CommitTypeDescription
126efc9972fixcancel reader when app is destroyed (#​61528)
efda872453fixprevent reading chunks if app is destroyed (#​61354)
compiler
CommitTypeDescription
44bb328eaefixavoid conflicts between HMR code and local symbols (#​61550)
compiler-cli
CommitTypeDescription
107180260ffixAlways retain prior results for all files (#​61487)
1191e62d70fixavoid ECMAScript private field metadata emit (#​61227)
core
CommitTypeDescription
2b1b14f4d3fixcleanup rxResource abort listener (#​58306)
8f9b05eaaafixcleanup testability subscriptions (#​61261)
eb53bda470fixenable stashing only when withEventReplay() is invoked (#​61352)
94f5a4b4d6fixTesting should not throw when Zone does not patch test FW APIs (#​61376)
c0c69a5abcfixunregister onDestroy in toSignal. (#​61514)
platform-server
CommitTypeDescription
8edafd0559perfspeed up resolution of base (#​61392)
v19.2.11
Compare Source
v19.2.10
Compare Source
common
CommitTypeDescription
89056a0356fixcleanup updateLatestValue if view is destroyed before promise resolves (#​61064)
core
CommitTypeDescription
4623b61448fixmissing useExisting providers throwing for optional calls (#​61152)
400dbc5b89fixproperly handle app stabilization with defer blocks (#​61056)
platform-server
CommitTypeDescription
a6f0d5bc20fixless aggressive ngServerMode cleanup (#​61106)
v19.2.9
Compare Source
core
CommitTypeDescription
946b844e0dfixasync EventEmitter error should not prevent stability (#​61028)
dbb87026cafixcall DestroyRef on destroy callback if view is destroyed [patch] (#​61061)
2e140a136afixprevent stash listener conflicts [patch] (#​61063)
v19.2.8
Compare Source
forms
CommitTypeDescription
ea4a211216fixmake NgForm emit FormSubmittedEvent and FormResetEvent (#​60887)
v19.2.7
Compare Source
common
CommitTypeDescription
37ab6814f5fixissue a warning instead of an error when NgOptimizedImage exceeds the preload limit (#​60883)
core
CommitTypeDescription
b144126612fixinject migration: replace param with this. (#​60713)
http
CommitTypeDescription
d39e09da41fixInclude HTTP status code and headers when HTTP requests errored in httpResource (#​60802)
v19.2.6
Compare Source
compiler
CommitTypeDescription
3441f7b914fixerror if rawText isn't estimated correctly (#​60529) (#​60753)
compiler-cli
CommitTypeDescription
fc946c5f72fixensure HMR works with different output module type (#​60797)
core
CommitTypeDescription
00bbd9b382fixfix docs for output migration (#​60764)
f2bfa3151efixfix ng generate @​angular/core:output-migration. Fixes angular#​58650 (#​60763)
9241615ad0fixreduce total memory usage of various migration schematics (#​60776)
language-service
CommitTypeDescription
0e82d42774fixDo not provide element completions in end tag (#​60616)
fcdef1019ffixEnsure dollar signs are escaped in completions (#​60597)
v19.2.5
Compare Source
CommitTypeDescription
e61d06afb5fixstep 6 tutorial docs (#​60630)
animations
CommitTypeDescription
fa48f98d9ffixadd missing peer dependency on @angular/common (#​60660)
compiler
CommitTypeDescription
ca5aa4d55bfixthrow for invalid "as" expression in if block (#​60580)
compiler-cli
CommitTypeDescription
f4c4b10ea8fixProduce fatal diagnostic on duplicate decorated properties (#​60376)
22a0e54ac4fixsupport relative imports to symbols outside rootDir (#​60555)
core
CommitTypeDescription
64da69f7b6fixcheck ngDevMode for undefined (#​60565)
8f68d1bec3fixfix ng generate @​angular/core:output-migration (#​60626)
bc79985c65fixfix regexp for event types (#​60592)
006ac7f22ffixfixes #​592882 ng generate @​angular/core:signal-queries-migration (#​60688)
da6e93f434fixpreserve comments in internal inject migration (#​60588)
dbbddd1617fixprevent omission of deferred pipes in full compilation (#​60571)
language-service
CommitTypeDescription
0e9e0348ddfixUpdate adapter to log instead of throw errors (#​60651)
migrations
CommitTypeDescription
15f53f035bfixhandle shorthand assignments in super call (#​60602)
4b161e6234fixinject migration not handling super parameter referenced via this (#​60602)
router
CommitTypeDescription
958e98e4f7fixAdd missing types to transition (#​60307)
service-worker
CommitTypeDescription
7cd89ad2c6fixassign initializing client's app version, when a request is for worker script (#​58131)
v19.2.4
Compare Source
core
| Commit
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
kodiakhq[bot]
kodiakhqBot
approved these changes
Dec 2, 2025
View reviewed changes
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
df3da4f to
d8615d9CompareJanuary 9, 2026 20:58
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.17 [SECURITY]Update dependency @angular/compiler to v19.2.18 [SECURITY]Jan 9, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
d8615d9 to
b334b69CompareMarch 14, 2026 01:15
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.18 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY]Mar 14, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026
@renovate
renovateBot
deleted the

renovate/npm-angular-compiler-vulnerability

branch
March 27, 2026 02:13
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
b334b69 to
2e02d02CompareMarch 30, 2026 17:57
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY] - autoclosedUpdate dependency @angular/compiler to v19.2.20 [SECURITY]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
2 times, most recently
from
2e02d02 to
f16f107CompareApril 27, 2026 22:28
@renovaterenovateBot
changed the title
Update dependency @angular/compiler to v19.2.20 [SECURITY]Update dependency @angular/compiler to v19.2.22 [SECURITY]Jun 15, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
f16f107 to
964aa86CompareJune 15, 2026 22:16
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@kodiakhqkodiakhq[bot]kodiakhq[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants