Angular XSS Vulnerability Puts Thousands of Web Apps at Risk

A newly disclosed high-severity vulnerability in Angular’s core framework and compiler components is raising concerns across the web development and security communities.

Tracked as CVE-2026-32635, the flaw enables cross-site scripting (XSS) attacks through improper handling of internationalization (i18n) attribute bindings, potentially exposing thousands of applications to client-side compromise.

The issue, published via GitHub Security Advisory GHSA-g93w-mfhg-p222, affects multiple Angular versions ranging from v17 through v22 pre-release builds.

Given Angular’s widespread adoption in enterprise and consumer-facing applications, the vulnerability significantly expands the attack surface for web-based threats.

Root Cause: Sanitization Bypass via i18n

At its core, the vulnerability stems from a bypass of Angular’s built-in sanitization mechanisms when developers use internationalization attributes alongside security-sensitive HTML attributes.

Angular typically sanitizes values bound to attributes such as href, src, or formaction to prevent script injection.

However, when developers add an i18n-* attribute (e.g., i18n-href) to enable localization, the framework unintentionally skips this sanitization step.

A vulnerable implementation may look like:

<a href=”{{maliciousUrl}}” i18n-href>Click me</a>

If maliciousUrl is derived from untrusted input such as query parameters or API responses, an attacker can inject payloads like JavaScript: URLs, leading to script execution in the user’s browser.

Security researchers confirmed that multiple sensitive attributes are impacted, including:

• href, src, action, formaction
• data, background, poster, longdesc
• cite, codebase, itemtype, xlink:href

Because these attributes are commonly used in dynamic web applications, the flaw is particularly dangerous in real-world deployments where user-controlled data is frequently bound to templates.

Impact and Exploitation

Successful exploitation allows attackers to execute arbitrary JavaScript within the context of a victim’s browser session.

This can lead to:

• Session hijacking through cookie theft
• Data exfiltration from forms or DOM elements
• Unauthorized actions performed on behalf of users

The vulnerability requires relatively low privileges and minimal user interaction, as reflected in its CVSS v4 score classification (High severity).

Attackers only need to inject malicious input into a vulnerable binding that is marked for internationalization.

The vulnerability impacts the following Angular packages:

• @angular/compiler
• @angular/core

Affected versions include:

• 17.0.0-next.0 through 18.2.14
• 19.x before 19.2.20
• 20.x before 20.3.18
• 21.x before 21.2.4
• 22.0.0-next builds before next.3

The issue has been resolved in:

• 19.2.20
• 20.3.18
• 21.2.4
• 22.0.0-next.3

Notably, no patch is available for Angular 17–18 LTS branches, increasing risk for organizations still running older versions.

Mitigation and Workarounds

Developers are strongly advised to upgrade to patched versions immediately.

Where patching is not feasible, temporary mitigations include:

• Avoid binding untrusted user input to sensitive attributes
• Do not combine i18n-* attributes with dynamic bindings on security-critical fields
• Explicitly sanitize inputs using Angular’s DomSanitizer

For example, developers can enforce sanitization like this:

Use DomSanitizer with SecurityContext.URL to neutralize potentially dangerous values before binding them to attributes.

This vulnerability highlights a subtle but critical gap between framework-level security guarantees and developer-intended features like localization.

It underscores how seemingly safe abstractions such as Angular’s automatic sanitization can fail under specific feature interactions.

For security teams, this serves as a reminder to audit frontend frameworks not just for known vulnerabilities, but also for edge-case behaviors introduced by advanced features like internationalization, templating, and dynamic bindings.

Organizations running Angular-based applications should prioritize patching and conduct code reviews to identify risky i18n usage patterns before attackers exploit them at scale.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google