A serious security hole in Angular, a top web framework used by millions of developers, exposes apps to attacks.
Tracked as CVE-2026-27970, this high-severity cross-site scripting (XSS) vulnerability hits the framework’s internationalization (i18n) system.
Attackers who tamper with translation files can inject and run harmful JavaScript in users’ browsers, risking data theft and app sabotage.
How the Vulnerability Works
Angular’s i18n handles complex translations like plurals or gender-specific text using ICU message formats.
Developers extract messages into files like .xliff or .xtb, send them for translation—often to outside teams and merge them back.
The flaw? Angular doesn’t fully sanitize HTML in these translated texts. If attackers hack the translation process, they slip in malicious scripts.
When the app loads the tainted file, the code runs with the app’s full privileges.
This differs from typical XSS, where users input bad data. Here, compromise starts upstream in supply-chain style attacks on translation workflows.
Once executed, attackers can steal credentials from browser storage (cookies, LocalStorage, IndexedDB) or vandalize the page, like swapping content or redirecting users.
| Detail | Information |
|---|---|
| CVE ID | CVE-2026-27970 |
| Component | @angular/core |
| Vulnerability Type | Cross-Site Scripting (XSS) (CWE-79) |
| Severity | High |
| CVSS v4 Score Metrics | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| Affected Versions | <= 18.2.14; >= 19.0.0-next.0 <= 19.2.18; >= 20.0.0-next.0 <= 20.3.16; >= 21.0.0-next.0 <= 21.1.5; >= 21.2.0-next.0 <= 21.2.0-rc.0 |
| Patched Versions | 19.2.19, 20.3.17, 21.1.6, 21.2.0 |
Apps in finance, e-commerce, or enterprise dashboards face the biggest threats. A single bad translation file could hit thousands of users.
CVSS metrics show network access (AV:N) with low complexity (AC:L), but it needs user interaction (UI:P) like loading a page.
Update now: Patch to Angular 19.2.19, 20.3.17, 21.1.6, or 21.2.0. Angular’s team fixed sanitization in the i18n pipeline.
Can’t patch yet? Vet all third-party translations manually. Scan .xliff/.xtb files for scripts using tools like grep or IDE linters.
Layer defenses:
- Set strict Content-Security-Policy (CSP) headers to block inline scripts:
script-src 'self';. - Enable Trusted Types in browsers for safe HTML parsing.
- Use Angular’s DomSanitizer for extra checks on dynamic content.
Security firms urge supply-chain audits for i18n workflows. This flaw highlights risks in trusted third-party inputs.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=Tracked as CVE-2026-27970, this high-severity cross-site scripting (XSS) vulnerability hits the framework's internationalization (i18n) system.){kind=link}