New Angular Vulnerability
A high Cross-Site Scripting (XSS) vulnerability has been discovered in Angular’s Template Compiler, potentially exposing millions of web applications to malicious JavaScript execution.
The flaw, tracked as CVE-2026-22610, affects multiple versions of Angular’s core packages and carries a High severity rating with a CVSS score of 7.3/10.
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-22610 |
| Severity | High (CVSS 4.0: 7.3/10) |
| Vulnerability Type | Cross-Site Scripting (XSS) – CWE-79 |
The security flaw stems from Angular’s internal sanitization schema failing to recognize href and xlink properly:href attributes in SVG <script> elements as Resource URL contexts.
This oversight allows attackers to bypass Angular’s built-in security protections when template binding assigns user-controlled data to these attributes.
When developers use property or attribute binding, such as <script [attr.href]=”userInput”>, the compiler incorrectly treats malicious input as standard strings rather than potentially dangerous resource links.
Attackers can exploit this by injecting data URIs containing JavaScript (data: text/javascript) or by using external malicious script URLs.
Successful exploitation enables arbitrary JavaScript execution in victims’ browser sessions, leading to session hijacking, data exfiltration, and unauthorized actions performed on behalf of authenticated users.
However, exploitation requires specific preconditions: applications must use SVG <script> elements with property binding on href or xlink:href attributes, and the bound data must originate from untrusted sources.
Angular has released patches across multiple version branches. Administrators should immediately update to the patched versions 19.2.18, 20.3.16, 21.0.7, or 21.1.0-rc.0.
Until patches are applied, developers should avoid dynamic bindings on SVG <script> elements and implement strict server-side input validation against trusted URL allowlists.
Organizations using the Angular framework should prioritize this update to prevent potential exploitation of their web applications.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…