Skip to content
OpenAdvisories

Package · npm

@angular/compiler

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2026-88057

    Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or sele…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 7.6
    CVE-2026-69151

    Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler …

    angular angular core compiler Debian Ubuntu npm
  • Medium 5.3
    CVE-2026-54265

    Angular: Two-Way Property Binding Sanitization Bypass (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization thr…

    angular angular angular.js angular.js Debian Ubuntu npm
  • Medium 5.3
    CVE-2026-50557

    Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassi…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.6
    CVE-2026-32635 Public exploit

    Angular has XSS in i18n attribute bindings

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Ang…

    angular compiler core angular.js Debian Ubuntu npm
  • High 8.5
    CVE-2026-22610 Public exploit

    Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in …

    angular angular angular.js @angular/core Ubuntu npm
  • High 8.5
    CVE-2025-66412

    Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Tem…

    angular angular angular.js @angular/compiler Ubuntu npm