cve.bz

CVE-2026-22610

8.5 highEPSS 0.4%

High (8.5) in angular angular. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in @angular/compiler 19.2.18, 20.3.16, 21.0.7.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

Severity

CVSS 4.0

8.5 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-jrmj-c5cx-3cw6npm@angular/compiler>=21.1.0-next.0 <21.1.0-rc.021.1.0-rc.0
GHSA-jrmj-c5cx-3cw6npm@angular/core>=21.1.0-next.0 <21.1.0-rc.021.1.0-rc.0
GHSA-jrmj-c5cx-3cw6npm@angular/compiler>=21.0.0-next.0 <21.0.721.0.7
GHSA-jrmj-c5cx-3cw6npm@angular/core>=21.0.0-next.0 <21.0.721.0.7
GHSA-jrmj-c5cx-3cw6npm@angular/compiler>=20.0.0-next.0 <20.3.1620.3.16
GHSA-jrmj-c5cx-3cw6npm@angular/core>=20.0.0-next.0 <20.3.1620.3.16
GHSA-jrmj-c5cx-3cw6npm@angular/compiler>=19.0.0-next.0 <19.2.1819.2.18
GHSA-jrmj-c5cx-3cw6npm@angular/core>=19.0.0-next.0 <19.2.1819.2.18
GHSA-jrmj-c5cx-3cw6npm@angular/compiler<=18.2.14no fix published
GHSA-jrmj-c5cx-3cw6npm@angular/core<=18.2.14no fix published

References

Check your stackJSON