Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-32635 Details

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/angular/angular/pull/67541	[email protected]	Issue TrackingPatch
https://github.com/angular/angular/pull/67561	[email protected]	Issue TrackingPatch
https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222	[email protected]	MitigationVendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

Product	Versions
angular angular cli	>= 17.0.0, < 19.2.0 >= 20.0.0, <= 20.3.18 >= 21.0.0, < 21.2.4 22.0.0 next0 22.0.0 next1
CPE cpe:2.3:a:angular:angular_cli:::::::: cpe:2.3:a:angular:angular_cli:22.0.0:next0:::::: cpe:2.3:a:angular:angular_cli:22.0.0:next1:::::: Remediation No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Apr 30, 2026	Initial Analysis	[email protected]
Mar 16, 2026	New CVE Received	[email protected]