XSS Vulnerability in Angular's Compiler Affects Web Application Security
CVE-2026-54265
5.3MEDIUM
What is CVE-2026-54265?
The Angular compiler had a serious flaw that allowed for the bypassing of DOM property sanitization due to improper handling of two-way property bindings. Before version 22.0.1, Angular could emit native two-way DOM bindings without the necessary sanitation functions, which could lead to a potential XSS attack if an attacker could control sensitive property values. This issue underscores the need for developers to stay updated with version 22.0.1 or later to bolster web application security.
Affected Version(s)
angular >= 22.0.0-next.0 < 22.0.1 < 22.0.0-next.0 22.0.1
angular >= 21.0.0-next.0 < 21.2.17 < 21.0.0-next.0 21.2.17
angular >= 20.0.0-next.0 < 20.3.25 < 20.0.0-next.0 20.3.25