Angular
CVE-2026-22610
HIGH
GHSA-jrmj-c5cx-3cw6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
9DescriptionGitHub Advisory
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.
AnalysisAI
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized href and xlink:href attributes on SVG <script> elements bound to untrusted data. Affects Angular versions prior to 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, with no public exploit identified at time of analysis despite a very low EPSS score of 0.01%. Patched releases are available from the Angular project, and exploitation requires the victim application to dynamically bind user-controlled values to those specific SVG script attributes.
Technical ContextAI
Angular is a TypeScript/JavaScript framework for building single-page web applications, and its Template Compiler is responsible for transforming HTML templates into rendering instructions that include automatic sanitization wrappers. The root cause is a CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw in the compiler's DOM security schema (dom_security_schema.ts) and runtime sanitization logic (sanitization.ts), which only treated href on base/link and src on embed/frame/iframe/media/script as Resource URL contexts. Because script|href and script|xlink:href were missing from the SECURITY_SCHEMA map and the getUrlSanitizer routing, Angular emitted the weaker ɵɵsanitizeUrl instead of ɵɵsanitizeResourceUrl for SVGScriptElement href bindings - allowing javascript:/data: URIs and remote script references to pass through. The patch adds those attribute keys to the schema, introduces SRC_RESOURCE_TAGS/HREF_RESOURCE_TAGS sets, and routes script xlink:href through ɵɵsanitizeResourceUrl. The CPE list confirms the affected ecosystem is the @angular/angular Node.js packages, with the 21.1.0-next.0 through next.4 prereleases explicitly enumerated.
RemediationAI
Vendor-released patches are available: upgrade @angular/core and @angular/compiler to 19.2.18, 20.3.16, 21.0.7, or 21.1.0-rc.0 depending on the release line in use, as documented in https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6 and the fixing commit https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56. As a workaround until upgrading, avoid using Angular template property/attribute binding (e.g., [attr.href], [attr.xlink:href]) on SVG <script> elements entirely - refactor templates to use static script references or non-SVG script loading patterns, with the trade-off of losing any dynamic SVG scripting behavior. If dynamic values must be used, strictly validate them server-side against an allowlist of trusted URLs before they reach the template, accepting that allowlist maintenance and false-rejections are the trade-off. Siemens customers should additionally review SSA-253495 and SSA-485750 for product-specific guidance.
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" i
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hiera
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today