Packages

HighVulnerabilityGHSA-jrmj-c5cx-3cw6CVE-2026-22610Published 9 Jan 2026

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

Affected releases · @angular/compiler

  • 21.x21.0.0 – 21.0.6Fixed in 21.0.7
  • 20.x20.0.0 – 20.3.15Fixed in 20.3.16
  • 19.x19.0.0 – 19.2.17Fixed in 19.2.18
  • 18.x and older2.0.0 – 18.2.14No fix, no longer updated

On 21.x, the newest line:

npm install @angular/compiler@21.0.7
22.x

  1. Not affected

    22.0.0 – 22.2.3

    22 releases, latest

21.x

  1. Affected

    21.0.0 – 21.0.6

    7 releases

  2. Fixed

    21.0.7 – 21.2.25

    36 releases

20.x

  1. Affected

    20.0.0 – 20.3.15

    37 releases

  2. Fixed

    20.3.16 – 20.3.34

    19 releases

19.x

  1. Affected

    19.0.0 – 19.2.17

    35 releases

  2. Fixed

    19.2.18 – 19.2.25

    8 releases

18.x

  1. Affected

    18.0.0 – 18.2.14

    29 releases

17.x

  1. Affected

    17.0.0 – 17.3.12

    32 releases

16.x

  1. Affected

    16.0.0 – 16.2.12

    30 releases

15.x

  1. Affected

    15.0.0 – 15.2.10

    22 releases

14.x

  1. Affected

    14.0.0 – 14.3.0

    26 releases

13.x

  1. Affected

    13.0.0 – 13.4.0

    30 releases

12.x

  1. Affected

    12.0.0 – 12.2.17

    30 releases

11.x

  1. Affected

    11.0.0 – 11.2.14

    28 releases

10.x

  1. Affected

    10.0.0 – 10.2.5

    28 releases

9.x

  1. Affected

    9.0.0 – 9.1.13

    22 releases

8.x

  1. Affected

    8.0.0 – 8.2.14

    23 releases

7.x

  1. Affected

    7.0.0 – 7.2.16

    27 releases

6.x

  1. Affected

    6.0.0 – 6.1.10

    20 releases

5.x

  1. Affected

    5.0.0 – 5.2.11

    22 releases

4.x

  1. Affected

    4.0.0 – 4.4.7

    30 releases

2.x

  1. Affected

    2.0.0 – 2.4.10

    24 releases

587 stable releases of @angular/compiler, oldest to newest, one row per major.

Affected releases · @angular/core

  • 21.x21.0.0 – 21.0.6Fixed in 21.0.7
  • 20.x20.0.0 – 20.3.15Fixed in 20.3.16
  • 19.x19.0.0 – 19.2.17Fixed in 19.2.18
  • 18.x and older2.0.0 – 18.2.14No fix, no longer updated

On 21.x, the newest line:

npm install @angular/core@21.0.7
22.x

  1. Not affected

    22.0.0 – 22.2.3

    22 releases, latest

21.x

  1. Affected

    21.0.0 – 21.0.6

    7 releases

  2. Fixed

    21.0.7 – 21.2.25

    36 releases

20.x

  1. Affected

    20.0.0 – 20.3.15

    37 releases

  2. Fixed

    20.3.16 – 20.3.34

    19 releases

19.x

  1. Affected

    19.0.0 – 19.2.17

    35 releases

  2. Fixed

    19.2.18 – 19.2.25

    8 releases

18.x

  1. Affected

    18.0.0 – 18.2.14

    29 releases

17.x

  1. Affected

    17.0.0 – 17.3.12

    32 releases

16.x

  1. Affected

    16.0.0 – 16.2.12

    30 releases

15.x

  1. Affected

    15.0.0 – 15.2.10

    22 releases

14.x

  1. Affected

    14.0.0 – 14.3.0

    26 releases

13.x

  1. Affected

    13.0.0 – 13.4.0

    30 releases

12.x

  1. Affected

    12.0.0 – 12.2.17

    30 releases

11.x

  1. Affected

    11.0.0 – 11.2.14

    28 releases

10.x

  1. Affected

    10.0.0 – 10.2.5

    28 releases

9.x

  1. Affected

    9.0.0 – 9.1.13

    22 releases

8.x

  1. Affected

    8.0.0 – 8.2.14

    23 releases

7.x

  1. Affected

    7.0.0 – 7.2.16

    27 releases

6.x

  1. Affected

    6.0.0 – 6.1.10

    20 releases

5.x

  1. Affected

    5.0.0 – 5.2.11

    22 releases

4.x

  1. Affected

    4.0.0 – 4.4.7

    30 releases

2.x

  1. Affected

    2.0.0 – 2.4.10

    24 releases

587 stable releases of @angular/core, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/compiler. It is read in your browser and sent nowhere.

Is your project affected?

Paste your package.json, or type the range you declare for @angular/core. It is read in your browser and sent nowhere.

What happens

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.

In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.

When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.

Impact

When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:

  • Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.

  • Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.

  • Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.

Attack Preconditions

  1. The victim application must explicitly use SVG <script> elements within its templates.

  2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.

  3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).

Patches

  • 19.2.18

  • 20.3.16

  • 21.0.7

  • 21.1.0-rc.0

Workarounds

Until the patch is applied, developers should:

  • Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.

  • Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.

Resources