CVE-2026-32635: Angular XSS Vulnerability in i18n Attribute Bindings
Summary
CVE-2026-32635: Angular vulnerable to XSS in i18n attribute bindings. Affects @angular/core across 5 version ranges.
>= 17.0.0.next.0, <= 18.2.14
>= 19.0.0.next.0, < 19.2.20
>= 20.0.0-next.0.0.0, < 20.3.18
>= 21.0.0-next.0, < 21.2.4
>= 22.0.0-next.0, < 22.0.0-next.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular is a popular open-source web application framework maintained by Google, designed for building dynamic single-page applications. It provides developers with a robust set of tools for creating interactive user interfaces and managing application state. However, a recent vulnerability has been discovered that affects its internationalization feature, specifically when binding sensitive attributes to untrusted user input.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. This issue arises when applications use security-sensitive attributes, such as href on anchor tags, in conjunction with Angular's internationalization capabilities. By adding an 'i18n-<attribute>' name, the built-in sanitization mechanism is bypassed, allowing attackers to inject malicious scripts through untrusted user-generated data. The impact of this vulnerability can lead to session hijacking, data exfiltration, and unauthorized actions within the application.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/core@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 19.0.0.next.0, < 19.2.2019.2.20npm install @angular/core@19.2.20 -
>= 20.0.0-next.0.0.0, < 20.3.1820.3.18npm install @angular/core@20.3.18 -
>= 21.0.0-next.0, < 21.2.421.2.4npm install @angular/core@21.2.4 -
>= 22.0.0-next.0, < 22.0.0-next.322.0.0-next.3npm install @angular/core@22.0.0-next.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Until the patch is applied, ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input. Alternatively, explicitly sanitize your attributes using Angular's DomSanitizer as shown below:
import { Component, inject, SecurityContext } from '@angular/core';
import { DomSanitizer } from '@angular/platform-browser';
@Component({
template: `
<form action="{{url}}" i18n-action>
<button>Submit</button>
</form>
`,
})
export class App {
url: string;
constructor() {
const dangerousUrl = 'javascript:alert(1)';
const sanitizer = inject(DomSanitizer);
this.url = sanitizer.sanitize(SecurityContext.URL, dangerousUrl) || '';
}
}
Conclusion
The XSS vulnerability in Angular's i18n attribute bindings poses significant risks to applications using untrusted user input. It is crucial to update to the patched versions of Angular or implement workarounds to mitigate potential attacks. Regular monitoring with tools like Vulert can help maintain application security.
See every vulnerability recorded for @angular/core →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
The vulnerability affects Angular versions prior to the patched versions: 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Exploitation of this vulnerability can lead to session hijacking, data exfiltration, and unauthorized actions performed on behalf of users.
As a temporary measure, ensure that any data bound to the vulnerable attributes is not sourced from untrusted user input and consider sanitizing inputs using Angular's DomSanitizer.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/core.
