Cross-Site Scripting Vulnerability in Angular Development Platform
CVE-2026-69151
7.6HIGH
What is CVE-2026-69151?
The Angular development platform, widely used for building mobile and desktop web applications, has a vulnerability in its i18n pipeline. Versions prior to 20.3.27, 21.2.19, and 22.0.1 allow unauthenticated translation files to inject executable JavaScript into applications through i18n-onerror and other event-handler attributes. This poses significant security risks, as it may allow attackers to manipulate static application behaviors, potentially leading to unauthorized actions within applications.
Affected Version(s)
angular >= 22.0.0-next.0, < 22.0.1 < 22.0.0-next.0, 22.0.1
angular >= 21.0.0-next.0, < 21.2.19 < 21.0.0-next.0, 21.2.19
angular < 20.3.27 < 20.3.27