angular compiler vulnerabilities

Latest angular compiler CVEs

Newest publication first

1. CVE-2026-88057 Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

   Published 2026-09-10

   Medium·CVSS 5.3 EPSS 0.37%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanit...

2. CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

   Published 2026-08-03

   High·CVSS 7.6 EPSS 0.33%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing...

3. CVE-2026-54265 Angular: Two-Way Property Binding Sanitization Bypass (XSS)

   Published 2026-06-22

   Medium·CVSS 5.3 EPSS 0.34%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-w...

4. CVE-2026-50557 Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

   Published 2026-06-22

   Medium·CVSS 5.3 EPSS 0.41%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attrib...

5. CVE-2026-32635 Angular has XSS in i18n attribute bindings

   Published 2026-03-13

   High·CVSS 8.6 EPSS 0.54%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and comp...

6. CVE-2026-22610 Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

   Published 2026-01-10

   High·CVSS 8.5 EPSS 0.44%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template...

7. CVE-2025-66412 Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

   Published 2025-12-01

   High·CVSS 8.5 EPSS 0.38%

   Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It oc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.