CVE-2026-54265
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
How to fix
- angular angular20.3.25, 21.2.17, 22.0.1 or later
- @angular/compiler22.0.1, 21.2.17, 20.3.25 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| angular angular | v ≤ 19.2.25, 20.0.0 ≤ v < 20.3.25, 21.0.0 ≤ v < 21.2.17, 22.0.0 ≤ v < 22.0.1 | 20.3.25, 21.2.17, 22.0.1 |
| @angular/compilernpm | 22.0.0-next.0 ≤ v < 22.0.1, 21.0.0-next.0 ≤ v < 21.2.17, 20.0.0-next.0 ≤ v < 20.3.25, v ≤ 19.2.25 | 22.0.1, 21.2.17, 20.3.25 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.