Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| @angular | compiler | >= 22.0.0-next.0, < 22.0.0-next.3, >= 21.0.0-next.0, < 21.2.4, >= 20.0.0-next.0, < 20.3.18, >= 17.0.0.next.0, < 19.2.20 | — |
| @angular | core | >= 22.0.0-next.0, < 22.0.0-next.3, >= 21.0.0-next.0, < 21.2.4, >= 20.0.0-next.0, < 20.3.18, >= 17.0.0.next.0, < 19.2.20 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | angular.js | No fix yet | — |
| Debian 12 | angular.js | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | angular.js | No fix yet | — |
| Ubuntu 26.04 LTS | angular.js | No fix yet | — |
| Ubuntu 25.10 | angular.js | No fix yet | — |
| Ubuntu 24.04 LTS | angular.js | No fix yet | — |
| Ubuntu 22.04 LTS | angular.js | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | angular.js | No fix yet | — |
| Ubuntu Pro 18.04 LTS | angular.js | No fix yet | — |
| Ubuntu Pro 16.04 LTS | angular.js | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
fevar54/CVE-2026-32635-Angular-XSS-Mitigation- ★ 0 · Aug 25, 2026
Demostracion educativa de mitigacion y deteccion de CVE-2026-32635: XSS en atributos i18n de Angular.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @angular/compiler | >= 22.0.0-next.0, < 22.0.0-next.3 | 22.0.0-next.3 | GHSA-g93w-mfhg-p222 |
| npm | @angular/compiler | >= 21.0.0-next.0, < 21.2.4 | 21.2.4 | GHSA-g93w-mfhg-p222 |
| npm | @angular/compiler | >= 20.0.0-next.0.0.0, < 20.3.18 | 20.3.18 | GHSA-g93w-mfhg-p222 |
| npm | @angular/compiler | >= 19.0.0-next.0, < 19.2.20 | 19.2.20 | GHSA-g93w-mfhg-p222 |
| npm | @angular/compiler | >= 17.0.0-next.0, <= 18.2.14 | — | GHSA-g93w-mfhg-p222 |
| npm | @angular/core | >= 22.0.0-next.0, < 22.0.0-next.3 | 22.0.0-next.3 | GHSA-g93w-mfhg-p222 |
| npm | @angular/core | >= 21.0.0-next.0, < 21.2.4 | 21.2.4 | GHSA-g93w-mfhg-p222 |
| npm | @angular/core | >= 20.0.0-next.0.0.0, < 20.3.18 | 20.3.18 | GHSA-g93w-mfhg-p222 |
| npm | @angular/core | >= 19.0.0-next.0, < 19.2.20 | 19.2.20 | GHSA-g93w-mfhg-p222 |
| npm | @angular/core | >= 17.0.0-next.0, <= 18.2.14 | — | GHSA-g93w-mfhg-p222 |
Advisories 1
- WID-SEC-2026-0728 Angular: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Mar 15, 2026