CVE-2026-54265: @angular/compiler Two-Way Property Binding Sanitization Bypass (XSS)
Summary
CVE-2026-54265: @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS). Affects @angular/compiler across 4 version ranges.
< 19.2.25
>= 20.0.0-next.0, < 20.3.25
>= 21.0.0-next.0, < 21.2.17
>= 22.0.0-next.0, < 22.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/compiler package is a core component of the Angular framework, which is widely used for building dynamic web applications. It provides the necessary tools for compiling Angular templates into executable JavaScript code. This package is essential for rendering views and handling data binding in Angular applications. However, it has been found to have a vulnerability that allows for Cross-Site Scripting (XSS) attacks through improper sanitization of two-way property bindings.
Vulnerability Detail
An issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. When sensitive native DOM properties (like innerHTML, src, href) are bound using two-way binding syntax, the Angular template compiler fails to apply the necessary sanitization. This flaw enables attackers to inject unsanitized values, leading to potential XSS attacks, which can result in session hijacking or unauthorized actions within the user's browser context.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/compiler@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/compiler@19.2.25 -
>= 20.0.0-next.0, < 20.3.2520.3.25npm install @angular/compiler@20.3.25 -
>= 21.0.0-next.0, < 21.2.1721.2.17npm install @angular/compiler@21.2.17 -
>= 22.0.0-next.0, < 22.0.122.0.1npm install @angular/compiler@22.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using two-way data binding on sensitive properties. Instead, use one-way bindings and manually sanitize any user-controlled input before binding it to the DOM. For example, instead of using <div [(innerHTML)]="userContent"></div>, use <div [innerHTML]="sanitizedContent"></div>, where sanitizedContent is processed through Angular's DomSanitizer.
Conclusion
The vulnerability identified as CVE-2026-54265 in the @angular/compiler package poses a significant risk due to improper sanitization of two-way property bindings. It is crucial for developers to update to the patched versions to secure their applications against potential XSS attacks. Additionally, implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for @angular/compiler →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
Versions 22.0.0-next.0, 21.0.0-next.0, 20.0.0-next.0, and all versions up to 19.2.25 are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting Vulert Scanner without needing to sign up.
Exploitation of this vulnerability can lead to Cross-Site Scripting (XSS), allowing attackers to execute arbitrary JavaScript in the user's browser, potentially leading to session hijacking or data exposure.
Yes, you can mitigate the risk by avoiding two-way bindings on sensitive properties and ensuring that any user-controlled input is sanitized before being bound to the DOM.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/compiler.
