New Angular Vulnerability Allows Attackers to Execute Malicious Payloads

A high Cross-Site Scripting (XSS) vulnerability has been discovered in Angular’s Template Compiler, potentially exposing millions of web applications to malicious JavaScript execution.

The flaw, tracked as CVE-2026-22610, affects multiple versions of Angular’s core packages and carries a High severity rating with a CVSS score of 7.3/10.

Attribute	Details
CVE ID	CVE-2026-22610
Severity	High (CVSS 4.0: 7.3/10)
Vulnerability Type	Cross-Site Scripting (XSS) – CWE-79

Vulnerability Details

The security flaw stems from Angular’s internal sanitization schema failing to recognize href and xlink properly:href attributes in SVG <script> elements as Resource URL contexts.

This oversight allows attackers to bypass Angular’s built-in security protections when template binding assigns user-controlled data to these attributes.

When developers use property or attribute binding, such as <script [attr.href]=”userInput”>, the compiler incorrectly treats malicious input as standard strings rather than potentially dangerous resource links.

Attackers can exploit this by injecting data URIs containing JavaScript (data: text/javascript) or by using external malicious script URLs.

Successful exploitation enables arbitrary JavaScript execution in victims’ browser sessions, leading to session hijacking, data exfiltration, and unauthorized actions performed on behalf of authenticated users.

However, exploitation requires specific preconditions: applications must use SVG <script> elements with property binding on href or xlink:href attributes, and the bound data must originate from untrusted sources.

Angular has released patches across multiple version branches. Administrators should immediately update to the patched versions  19.2.18, 20.3.16, 21.0.7, or 21.1.0-rc.0.

Until patches are applied, developers should avoid dynamic bindings on SVG <script> elements and implement strict server-side input validation against trusted URL allowlists.

Organizations using the Angular framework should prioritize this update to prevent potential exploitation of their web applications.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.