CVE-2026-69151 — Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the An…
Published: 2026-08-03 · CVSS: 7.6 · CVSS 4.0
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7