CVE-2026-27970: Angular i18n Cross-Site Scripting Vulnerability
Summary
CVE-2026-27970: Angular i18n vulnerable to Cross-Site Scripting. Affects @angular/core across 5 version ranges.
< 18.2.14
>= 19.0.0-next.0, < 19.2.19
>= 20.0.0-next.0, < 20.3.17
>= 21.0.0-next.0, < 21.1.6
>= 21.2.0-next.0, < 21.2.0
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Angular is a popular open-source web application framework maintained by Google, designed for building dynamic single-page applications. It provides a robust set of tools for developers, including a powerful internationalization (i18n) pipeline that allows applications to support multiple languages. However, a vulnerability has been identified in the i18n pipeline that can lead to Cross-Site Scripting (XSS) attacks if not properly managed.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability exists in the Angular internationalization (i18n) pipeline, specifically within ICU messages. The vulnerability arises when HTML from translated content is not adequately sanitized, allowing for the execution of arbitrary JavaScript. This issue can be exploited if an attacker compromises the translation files (e.g., xliff, xtb) used by the application. The consequences of this vulnerability can include credential exfiltration, where sensitive user data is stolen, and page vandalism, where the application behaves unexpectedly due to malicious scripts.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/core@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 18.2.1418.2.14npm install @angular/core@18.2.14 -
>= 19.0.0-next.0, < 19.2.1919.2.19npm install @angular/core@19.2.19 -
>= 20.0.0-next.0, < 20.3.1720.3.17npm install @angular/core@20.3.17 -
>= 21.0.0-next.0, < 21.1.621.1.6npm install @angular/core@21.1.6 -
>= 21.2.0-next.0, < 21.2.021.2.0npm install @angular/core@21.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Until the patch is applied, developers should consider the following workarounds: 1. Review and verify translated content received from untrusted third parties before incorporating it into the Angular application. 2. Enable strict Content Security Policy (CSP) controls to block unauthorized JavaScript from executing on the page. 3. Enable Trusted Types to enforce proper HTML sanitization.
Conclusion
The Angular i18n vulnerability (CVE-2026-27970) poses significant risks due to its potential for XSS attacks. It is crucial for developers to update their Angular packages to the latest patched versions and implement recommended workarounds to safeguard their applications against exploitation.
See every vulnerability recorded for @angular/core →
FAQ
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
An attacker must first compromise the translation files used by the application. Once the files are compromised, they can inject malicious content that gets executed in the user's browser.
The impacts can include credential theft, unauthorized access to sensitive data, and manipulation of the application's behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If you cannot update the package right away, implement the suggested workarounds to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
