CVE-2026-32635
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
How to fix
- angular angular_cli19.2.0, 21.2.4 or later
- @angular/core22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 or later
- @angular/compiler22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| angular angular_cli | 17.0.0 ≤ v < 19.2.0, 20.0.0 ≤ v ≤ 20.3.18, 21.0.0 ≤ v < 21.2.4, 22.0.0 | 19.2.0, 21.2.4 |
| @angular/corenpm | 22.0.0-next.0 ≤ v < 22.0.0-next.3, 21.0.0-next.0 ≤ v < 21.2.4, 20.0.0-next.0.0.0 ≤ v < 20.3.18, 19.0.0-next.0 ≤ v < 19.2.20, 17.0.0-next.0 ≤ v ≤ 18.2.14 | 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 |
| @angular/compilernpm | 22.0.0-next.0 ≤ v < 22.0.0-next.3, 21.0.0-next.0 ≤ v < 21.2.4, 20.0.0-next.0.0.0 ≤ v < 20.3.18, 19.0.0-next.0 ≤ v < 19.2.20, 17.0.0-next.0 ≤ v ≤ 18.2.14 | 22.0.0-next.3, 21.2.4, 20.3.18, 19.2.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.