Cross-Site Scripting Vulnerability in Angular.js - CVE-2026-27970
Summary
DEBIAN-CVE-2026-27970: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Affects angular.js versions 1.8.2-2 – 1.8.3-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular.js is a robust development platform used for building mobile and desktop web applications with TypeScript, JavaScript, and other languages. It is widely adopted for its powerful features, including two-way data binding, dependency injection, and modular development. However, certain versions of Angular.js are susceptible to a cross-site scripting (XSS) vulnerability that can compromise application security.
Vulnerability Detail
The vulnerability arises from improper sanitization of HTML content in the Angular internationalization (i18n) pipeline, specifically within ICU messages. When translations are processed, if an attacker compromises the translation files (such as xliff or xtb), they can inject malicious JavaScript. This can lead to arbitrary code execution in the application context, potentially resulting in credential theft or page vandalism. The exploitation requires the application to use Angular i18n, render ICU messages, and lack adequate content security policies.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Until the patch is applied, developers should review and verify translated content received from untrusted sources before integrating it into the Angular application. Additionally, enabling strict Content Security Policy (CSP) controls can help block unauthorized JavaScript execution. Here’s an example of a strict CSP header: Content-Security-Policy: default-src 'self'; script-src 'self';
Conclusion
The CVE-2026-27970 vulnerability poses a significant risk to applications using affected versions of Angular.js due to improper handling of translated content. It is crucial for developers to update to the patched versions and implement recommended workarounds to safeguard their applications.
See every vulnerability recorded for angular.js →
FAQ
CVE-2026-27970 is a cross-site scripting vulnerability found in certain versions of Angular.js that allows attackers to execute arbitrary JavaScript through compromised translation files.
Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to credential exfiltration, unauthorized actions on behalf of users, or defacement of the application.
If an immediate update is not possible, ensure to review and sanitize any untrusted translation content and implement strict CSP controls to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
