EUVD-2026-75678
GHSA-hh8m-fm6v-7cvg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires the application to use specific advanced Angular directive patterns, not just any Angular deployment; S:C for browser-context XSS.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on @angular/compiler (1 direct, 0 indirect)
- 1 npm packages depend on @angular/core (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 22.0.0 and other introduced versions.
DescriptionCVE.org
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.
AnalysisAI
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.2.20, and 22.1.0 allows unauthenticated remote attackers (with user interaction) to execute arbitrary JavaScript by bypassing built-in sanitization for security-sensitive host bindings. The compiler incorrectly derived SecurityContext from the declaring directive's CSS selector rather than the actual concrete host element, causing it to emit the wrong sanitizer-or no sanitizer at all-for attributes such as href, src, action, xlink:href, and data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Angular application uses one or more of the following specific patterns: (1) hostDirectives composition where a child directive's host binding resolves to a different element type than its own selector implies; (2) inherited @HostBinding declarations applied across a selector mismatch; (3) createComponent called with a custom hostElement that differs from the component's declared selector; (4) directives applied to SVG or MathML namespace elements; or (5) tag-neutral selectors such as :not(...) that match security-sensitive HTML elements. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N reflects the fundamental XSS pattern: network-reachable, no privileges needed from the attacker, but user interaction is required and the impact is bounded to the subsequent system (the user's browser context) rather than the Angular application server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Angular 20.3.28, 21.2.20, or 22.1.0 as appropriate for the installed major version, available at the tagged GitHub releases (github.com/angular/angular/releases/tag/v20.3.28, /v21.2.20, /v22.1.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" i
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hiera
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today