CVE-2026-52725: @angular/core Dynamic Component Namespace Bypass Leading to XSS
Summary
CVE-2026-52725: An issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Affects @angular/core across 5 version ranges.
< 18.2.14
>= 19.0.0-next.0, < 19.2.23
>= 20.0.0-next.0, < 20.3.22
>= 21.0.0-next.0, < 21.2.15
>= 22.0.0-next.0, < 22.0.0-rc.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/core package is a fundamental part of the Angular framework, which is widely used for building web applications. It provides essential functionalities such as component creation, dependency injection, and change detection. This package is known for its robust architecture and ability to create dynamic components. However, it is vulnerable to a specific issue that allows attackers to bypass security measures during dynamic component instantiation.
Vulnerability Detail
The vulnerability arises from a flaw in the dynamic component instantiation mechanism, specifically in the createComponent function. This function fails to prevent the mounting of components directly onto script elements, such as <script> or namespaced svg:script tags. As a result, an attacker who can control the host element or selector parameter can initialize an Angular component on a script tag, leading to the execution of untrusted code. This could result in client-side Cross-Site Scripting (XSS), allowing attackers to hijack sessions, expose sensitive data, or perform unauthorized actions on behalf of users.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/core@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 18.2.1418.2.14npm install @angular/core@18.2.14 -
>= 19.0.0-next.0, < 19.2.2319.2.23npm install @angular/core@19.2.23 -
>= 20.0.0-next.0, < 20.3.2220.3.22npm install @angular/core@20.3.22 -
>= 21.0.0-next.0, < 21.2.1521.2.15npm install @angular/core@21.2.15 -
>= 22.0.0-next.0, < 22.0.0-rc.222.0.0-rc.2npm install @angular/core@22.0.0-rc.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using user-controlled inputs as selectors or host elements for dynamic component creation. Implement additional input sanitization to ensure that user inputs do not lead to the instantiation of components on script tags.
Conclusion
The CVE-2026-52725 vulnerability in the @angular/core package poses a significant risk for Angular applications that utilize dynamic components. It is crucial to update to the patched versions to mitigate the risk of XSS attacks. Implementing workarounds and using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for @angular/core →
FAQ
CVE-2026-52725 is a vulnerability in the @angular/core package that allows attackers to bypass script-execution restrictions during dynamic component creation, leading to potential XSS attacks.
An attacker can exploit this vulnerability by controlling the host element or selector parameter passed to the createComponent function, allowing them to mount a component on a script tag.
Exploitation of this vulnerability can lead to session hijacking, exposure of sensitive data, and unauthorized actions performed on behalf of users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
If you cannot update the package immediately, implement input sanitization to prevent user-controlled inputs from being used as selectors or host elements for dynamic component creation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/core.
