CVE-2026-69151 Details
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline, affecting versions prior to 20.3.27, 21.2.19, and 22.0.1. The issue arises because the i18n pipeline allowed the use of event-handler attributes (like 'onerror' and 'onclick') to be marked for translation. This could enable a lower-trust translation file to replace a benign static event handler with executable JavaScript, potentially leading to arbitrary code execution within the application's domain.
Users can update to Angular versions 20.3.27, 21.2.19, or 22.0.1. Additionally, ensure that static event-handler attributes are not marked for internationalization in application templates, and source translation files from trusted origins.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| angular angular | <= 19.2.25 >= 20.0.0, < 20.3.27 >= 21.0.0, < 21.2.19 >= 22.0.0, < 22.0.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |