New Angular Vulnerability Enables an Attacker to Execute Malicious Payload

A critical Cross-Site Scripting (XSS) vulnerability has been identified in Angular's Template Compiler, impacting several versions of the @angular/compiler and @angular/core packages.

The vulnerability, tracked as CVE-2026-22610, permits attackers to circumvent Angular's security measures and execute arbitrary JavaScript code in victim browsers.

The flaw is located in Angular's internal sanitization schema, which fails to properly recognize the href and xlink:href attributes of SVG <script> elements as resource URLs needing strict validation.

This oversight allows the injection of malicious payloads via template bindings, enabling unauthorized code execution in user sessions.

Field Details

CVE ID CVE-2026-22610

Vulnerability Type Cross-Site Scripting (XSS)

CWE CWE-79: Improper Neutralization of Input During Web Page Generation

CVSS v4 Score 7.6 (High)

CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

When developers utilize Angular's property binding syntax (such as [attr.href]= "userInput" ), the compiler treats these SVG script attributes as regular strings, rather than resource links requiring validation.

This misclassification allows malicious data, including data: text/javascript URIs or external malicious script links, to bypass security checks. Exploiting this vulnerability can lead to severe consequences.

Attackers may steal session cookies, localStorage data, or authentication tokens to hijack user accounts. They could also exfiltrate sensitive information displayed within applications or perform unauthorized actions on behalf of authenticated users.

The vulnerability carries a CVSS v4 base score of 7.6 (High severity). It requires low attack complexity and relatively low privilege levels to exploit.

Angular Package Affected Versions Fixed / Safe Versions

@angular/compiler, @angular/core ≥ 21.1.0-next.0 and < 21.1.0-rc.0 21.1.0-rc.0 or later

@angular/compiler, @angular/core ≥ 21.0.0-next.0 and < 21.0.7 21.0.7 or later

@angular/compiler, @angular/core ≥ 20.0.0-next.0 and < 20.3.16 20.3.16 or later

@angular/compiler, @angular/core ≥ 19.0.0-next.0 and < 19.2.18 19.2.18 or later

@angular/compiler, @angular/core ≤ 18.2.14 No patch available — upgrade required

Exploitation requires specific conditions: the target application must use SVG <script> elements in templates with dynamic property or attribute bindings for href or xlink:href attributes, and the bound data must originate from untrusted sources.

Developers are advised to immediately update Angular to patched versions. Until patches are applied, avoid using dynamic bindings with SVG script elements and implement strict server-side input validation for any dynamic URL values before they reach templates.

Based on reporting by Cyber Security News.