CVE-2026-27970
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
An XSS vulnerability in the Angular i18n pipeline allows arbitrary JavaScript execution if an attacker compromises the translation file. Affects versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 due to unsanitized HTML in ICU messages.
Risk Assessment
Risk includes credential exfiltration and page vandalism, but requires prior compromise of the translation file by the attacker. Not easily exploitable by arbitrary users.
Recommendation
Upgrade Angular to versions 21.2.0, 21.1.6, 20.3.17, or 19.2.19 immediately. Until patched, review translations from untrusted sources, enforce strict CSP, and enable Trusted Types.
Other vulnerabilities in Angular
See all- CVE-2026-88060High
Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of untrusted input inside fallback raw-content elements (noscript, iframe, noembed, noframes) fails to escape matching closing tags, enabling arbitrary JavaScript execution.
- CVE-2026-88059Medium
In Angular prior to 20.3.28, 21.2.20, and 22.1.1, @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data.
- CVE-2026-88058High
Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of ProcessingInstruction DOM nodes inside fallback raw-content elements fails to escape matching ancestor closing tags, allowing premature container termination and arbitrary JavaScript execution.
- CVE-2026-88057Medium
In Angular prior to 20.3.28, 21.2.20, and 22.1.0, the compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context.
- CVE-2026-88056High
Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. The resolveUrl and parseUrl utilities call String.prototype.trim(), which removes leading Unicode whitespace after a same-origin check, converting a relative path into an attacker-controlled protocol-relative URL, leading to SSRF and credential disclosure.
- CVE-2026-69151Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.1 contains a vulnerability in the Angular compiler i18n pipeline that permits i18n-onerror and other i18n-on event-handler attributes. This allows a lower-trust translation file to replace a static handler with executable JavaScript.
- CVE-2026-69149Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.7 contains a Cross-Site Scripting (XSS) vulnerability in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).
- CVE-2026-68945Medium
Angular prior to versions 20.3.27, 21.2.19, and 22.0.2 contains a vulnerability in HttpTransferCache that comma-joins repeated request parameters. This allows semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response.
- CVE-2026-50556Medium
A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server component when serializing <noscript> elements during SSR. The domino library fails to escape </noscript> in dynamic content, allowing injection of malicious scripts.
- CVE-2026-50555Medium
A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server DOM emulation dependency (domino) when serializing raw-text elements like <script>, <style>, and <iframe>. A Unicode index alignment bug causes dynamic text with astral characters (e.g., emojis) before a closing tag to be improperly escaped, allowing JavaScript injection. The flaw is fixed in versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
Original NVD description (English source)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS