Packages

HighVulnerabilityGHSA-jj27-h5hq-8x99CVE-2026-69151Published 3 Aug 2026

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Affected releases · @angular/compiler

  • 22.x22.0.0Fixed in 22.0.1
  • 21.x21.0.0 – 21.2.18Fixed in 21.2.19
  • 20.x20.0.0 – 20.3.26Fixed in 20.3.27
  • 19.x19.0.0 – 19.2.25No fix on this line yet
  • 18.x and older2.0.0 – 18.2.14No fix, no longer updated

On 22.x, the newest line:

npm install @angular/compiler@22.0.1
22.x

  1. Affected

    22.0.0

    1 release

  2. Fixed

    22.0.1 – 22.2.3

    21 releases, latest

21.x

  1. Affected

    21.0.0 – 21.2.18

    36 releases

  2. Fixed

    21.2.19 – 21.2.25

    7 releases

20.x

  1. Affected

    20.0.0 – 20.3.26

    48 releases

  2. Fixed

    20.3.27 – 20.3.34

    8 releases

19.x

  1. Affected

    19.0.0 – 19.2.25

    43 releases

18.x

  1. Affected

    18.0.0 – 18.2.14

    29 releases

17.x

  1. Affected

    17.0.0 – 17.3.12

    32 releases

16.x

  1. Affected

    16.0.0 – 16.2.12

    30 releases

15.x

  1. Affected

    15.0.0 – 15.2.10

    22 releases

14.x

  1. Affected

    14.0.0 – 14.3.0

    26 releases

13.x

  1. Affected

    13.0.0 – 13.4.0

    30 releases

12.x

  1. Affected

    12.0.0 – 12.2.17

    30 releases

11.x

  1. Affected

    11.0.0 – 11.2.14

    28 releases

10.x

  1. Affected

    10.0.0 – 10.2.5

    28 releases

9.x

  1. Affected

    9.0.0 – 9.1.13

    22 releases

8.x

  1. Affected

    8.0.0 – 8.2.14

    23 releases

7.x

  1. Affected

    7.0.0 – 7.2.16

    27 releases

6.x

  1. Affected

    6.0.0 – 6.1.10

    20 releases

5.x

  1. Affected

    5.0.0 – 5.2.11

    22 releases

4.x

  1. Affected

    4.0.0 – 4.4.7

    30 releases

2.x

  1. Affected

    2.0.0 – 2.4.10

    24 releases

587 stable releases of @angular/compiler, oldest to newest, one row per major.

Affected releases · @angular/core

  • 22.x22.0.0Fixed in 22.0.1
  • 21.x21.0.0 – 21.2.18Fixed in 21.2.19
  • 20.x20.0.0 – 20.3.26Fixed in 20.3.27
  • 19.x19.0.0 – 19.2.25No fix on this line yet
  • 18.x and older2.0.0 – 18.2.14No fix, no longer updated

On 22.x, the newest line:

npm install @angular/core@22.0.1
22.x

  1. Affected

    22.0.0

    1 release

  2. Fixed

    22.0.1 – 22.2.3

    21 releases, latest

21.x

  1. Affected

    21.0.0 – 21.2.18

    36 releases

  2. Fixed

    21.2.19 – 21.2.25

    7 releases

20.x

  1. Affected

    20.0.0 – 20.3.26

    48 releases

  2. Fixed

    20.3.27 – 20.3.34

    8 releases

19.x

  1. Affected

    19.0.0 – 19.2.25

    43 releases

18.x

  1. Affected

    18.0.0 – 18.2.14

    29 releases

17.x

  1. Affected

    17.0.0 – 17.3.12

    32 releases

16.x

  1. Affected

    16.0.0 – 16.2.12

    30 releases

15.x

  1. Affected

    15.0.0 – 15.2.10

    22 releases

14.x

  1. Affected

    14.0.0 – 14.3.0

    26 releases

13.x

  1. Affected

    13.0.0 – 13.4.0

    30 releases

12.x

  1. Affected

    12.0.0 – 12.2.17

    30 releases

11.x

  1. Affected

    11.0.0 – 11.2.14

    28 releases

10.x

  1. Affected

    10.0.0 – 10.2.5

    28 releases

9.x

  1. Affected

    9.0.0 – 9.1.13

    22 releases

8.x

  1. Affected

    8.0.0 – 8.2.14

    23 releases

7.x

  1. Affected

    7.0.0 – 7.2.16

    27 releases

6.x

  1. Affected

    6.0.0 – 6.1.10

    20 releases

5.x

  1. Affected

    5.0.0 – 5.2.11

    22 releases

4.x

  1. Affected

    4.0.0 – 4.4.7

    30 releases

2.x

  1. Affected

    2.0.0 – 2.4.10

    24 releases

587 stable releases of @angular/core, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/compiler. It is read in your browser and sent nowhere.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/core. It is read in your browser and sent nowhere.

What happens

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).

When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.

The following example illustrates a vulnerable pattern:

<img src="foo.jpg" onerror="void 0" i18n-onerror />

Impact

When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to:

  • Session Hijacking: Accessing session cookies, tokens, or sensitive user data.

  • Unauthorized Actions: Performing actions on behalf of the authenticated user.

Patched Versions

  • 22.0.1

  • 21.2.19

  • 20.3.27

Workarounds

Ensure that static event-handler attributes (e.g., onerror, onclick) are never marked for internationalization (i18n-on*) in application templates, and ensure translation files are sourced from trusted origins.