Skip to content
OpenAdvisories

Package · npm

@angular/core

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Medium 5.3
    CVE-2026-88057

    Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or sele…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 7.6
    CVE-2026-69151

    Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler …

    angular angular compiler core Debian Ubuntu npm
  • High 8.6
    CVE-2026-54267

    Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular su…

    angular angular angular.js angular.js Debian Ubuntu npm
  • Medium 5.3
    CVE-2026-52725

    Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution re…

    angular angular angular.js angular.js Debian Ubuntu npm
  • Medium 5.3
    CVE-2026-50557

    Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassi…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.6
    CVE-2026-32635 Public exploit

    Angular has XSS in i18n attribute bindings

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Ang…

    angular compiler core angular.js Debian Ubuntu npm
  • High 7.6
    CVE-2026-27970

    Angular i18n vulnerable to Cross-Site Scripting (XSS)

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationali…

    angular angular angular.js angular.js Debian Ubuntu npm
  • High 8.5
    CVE-2026-22610 Public exploit

    Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in …

    angular angular angular.js @angular/core Ubuntu npm
  • Low 3.5
    CVE-2021-4231

    Angular Comment cross site scripting

    A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an …

    @angular/core npm