CVE-2026-50557: Angular Template and Attribute Namespace Sanitization Bypass (XSS)
Summary
CVE-2026-50557: Angular: Template and Attribute Namespace Sanitization Bypass (XSS). Affects @angular/core across 5 version ranges.
< 18.2.14
>= 19.0.0-next.0, < 19.2.22
>= 20.0.0-next.0, < 20.3.22
>= 21.0.0-next.0, < 21.2.15
>= 22.0.0-next.0, < 22.0.0-rc.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular is a popular open-source web application framework maintained by Google, designed for building dynamic web applications. It provides a robust structure for developing single-page applications (SPAs) with features like two-way data binding, dependency injection, and modular architecture. However, Angular applications that compile user-controlled templates at runtime are vulnerable to specific security issues, particularly related to sanitization of namespaced elements and attributes.
Vulnerability Detail
An issue in the @angular/compiler and @angular/core packages allows attackers to bypass element and attribute sanitization through specific namespace workarounds. Namespaced script elements, such as svg:script, were not properly identified by Angular's template preparser, allowing them to pass through template compilation without being stripped. This flaw enables an attacker to inject malicious script elements or dynamic attribute bindings, leading to client-side Cross-Site Scripting (XSS). The impact includes session hijacking, sensitive data exposure, and unauthorized actions on behalf of the user.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/core@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 18.2.1418.2.14npm install @angular/core@18.2.14 -
>= 19.0.0-next.0, < 19.2.2219.2.22npm install @angular/core@19.2.22 -
>= 20.0.0-next.0, < 20.3.2220.3.22npm install @angular/core@20.3.22 -
>= 21.0.0-next.0, < 21.2.1521.2.15npm install @angular/core@21.2.15 -
>= 22.0.0-next.0, < 22.0.0-rc.222.0.0-rc.2npm install @angular/core@22.0.0-rc.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using user-controlled inputs that are processed by the Angular template compiler at runtime. Additionally, implement separate input sanitization before feeding values to the Angular compiler to mitigate the risk of XSS attacks.
Conclusion
CVE-2026-50557 represents a significant security risk for Angular applications that compile user-controlled templates at runtime. By understanding the nature of this vulnerability and applying the necessary patches or workarounds, developers can protect their applications from potential XSS attacks and ensure user data remains secure.
See every vulnerability recorded for @angular/core →
FAQ
CVE-2026-50557 is a vulnerability in Angular that allows bypassing element and attribute sanitization, leading to potential XSS attacks.
If your Angular application compiles user-controlled templates at runtime, it may allow attackers to inject malicious scripts, compromising user data and session integrity.
Affected versions include @angular/core and @angular/compiler prior to 21.2.15, 22.0.0-rc.2, 20.3.22, and 19.2.23.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/core.
