Angular
CVE-2026-27970
HIGH
GHSA-prjf-86w9-mfqv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H and UI:R because exploitation requires first compromising the translation supply chain and a victim rendering the message; PR:N as no app privileges are needed; C:H/I:H for origin-scoped script execution, A:N as availability is unaffected.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
10DescriptionCVE.org
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization.
AnalysisAI
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute in the application origin when a poisoned translation file is merged into an app. The flaw affects Angular versions before 21.2.0, 21.1.16, 20.3.17, and 19.2.19, where HTML inside ICU (International Components for Unicode) messages from translated content was not sanitized before rendering. Exploitation is not open to arbitrary users - it requires first compromising a translation file (xliff, xtb, etc.), so this is effectively a supply-chain/third-party-translation risk; EPSS is very low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.
Technical ContextAI
Angular is a TypeScript/JavaScript front-end framework whose i18n workflow extracts source-language messages, sends them to translators, then merges returned translations back into the build. ICU message format supports plural/select constructs and interpolated content; the vulnerable code path rendered HTML embedded in these translated ICU messages without passing it through Angular's DomSanitizer, the standard defense against CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. XSS). The affected component is the Angular package as distributed via npm (CPE cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*), specifically builds compiled with i18n that render at least one ICU message. Because the untrusted data enters through the translation artifact rather than runtime user input, the trust boundary is the translation supply chain rather than the end-user request.
RemediationAI
Upgrade to a fixed Angular release for your line: Vendor-released patch: 21.2.0, 21.1.16, 20.3.17, or 19.2.19, delivered via commits 306f3678, 7d58b798, and b85830953 and pull request https://github.com/angular/angular/pull/67183 (advisory: https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv). Until you can patch, the most direct compensating control is to review and verify translated content received from untrusted third-party contractors before merging it into the build - this directly addresses the compromised-translation precondition but adds manual overhead to the localization workflow. Additionally, deploy a strict Content Security Policy (without 'unsafe-inline'/'unsafe-eval') to block injected script execution, accepting that a tight CSP may require refactoring inline handlers/styles, and enable Trusted Types to force HTML sanitization, which can break code paths that assign raw HTML and so should be tested before production rollout.
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" i
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hiera
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today