Riskcovery

CVE-2026-32635

Angular has XSS in i18n attribute bindings

State
Published
Severity
8.6 High
Published
Mar 13, 2026
Updated
Mar 17, 2026
Reserved
Mar 12, 2026

Read the record on cve.org

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

Scores

CVSSScoreVectorSource
4.08.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
compiler@angular
  • >= 22.0.0-next.0, < 22.0.0-next.3Affected
  • >= 21.0.0-next.0, < 21.2.4Affected
  • >= 20.0.0-next.0, < 20.3.18Affected
  • >= 17.0.0.next.0, < 19.2.20Affected
core@angular
  • >= 22.0.0-next.0, < 22.0.0-next.3Affected
  • >= 21.0.0-next.0, < 21.2.4Affected
  • >= 20.0.0-next.0, < 20.3.18Affected
  • >= 17.0.0.next.0, < 19.2.20Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.