CVE-2026-69151

Overview

Angular is a TypeScript-based web framework for building single-page and server-side rendered web applications, with a component-based architecture and a suite of built-in developer tooling.

A cross-site scripting vulnerability (CVE-2026-69151) has been identified in the Angular compiler's internationalization (i18n) pipeline. Angular's attribute validation normally blocks binding to event-handler attributes such as onclick and onerror, but the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (for example, i18n-onerror). A lower-trust translation file could then replace a benign static handler, such as onerror="void 0", with arbitrary executable JavaScript in the localized build.

Per OWASP: "Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites."

This issue affects Angular applications built with @angular/compiler and @angular/core in versions 19.2.25 and earlier, and in versions of the 20.x, 21.x, and 22.x lines prior to 20.3.27, 21.2.19, and 22.0.1 respectively.

‍

Details

Module Info

• Product: Angular
• Affected packages: @angular/compiler, @angular/core
• Affected versions:
  • <=19.2.25
  • >=20.0.0-next.0 <20.3.27
  • >=21.0.0-next.0 <21.2.19
  • >=22.0.0-next.0 <22.0.1
• GitHub repository: https://github.com/angular/angular
• Package manager: npm
• Published packages: https://www.npmjs.com/package/@angular/compiler and https://www.npmjs.com/package/@angular/core
• Fixed in:
  • NES for Angular
  • OSS Angular v20.3.27, v21.2.19, v22.0.1

Vulnerability Info

This High-severity vulnerability is found in the @angular/compiler and @angular/core packages, in the compiler's i18n (internationalization) metadata collection path.

Angular's template compiler normally rejects any attempt to bind or set an event-handler attribute, such as onclick or onerror, on an element, enforced by validateAttribute() and validateProperty(), precisely because those attributes execute arbitrary script. Angular separately lets a template author mark any attribute for translation with an i18n-* prefixed attribute, such as i18n-onerror, so a localization pipeline can vary that attribute's value per locale.

The i18n metadata collection path did not apply the same event-handler validation used for ordinary attribute binding, so i18n-on* attributes were treated as safe for translation. This allowed a lower-trust translation file, one supplied by a translation vendor, contractor, or compromised locale pipeline, to overwrite a static, benign handler with attacker-controlled JavaScript. Because the substitution happens when the localized build is compiled, the injected script runs in the production application for any user who loads the affected page in that locale, in the context of the vulnerable application's own domain.

If exploited, this can lead to session hijacking (accessing session cookies, tokens, or other sensitive user data) and unauthorized actions performed on behalf of the authenticated user, consistent with the vulnerability's high confidentiality and integrity impact under CVSS v4.0.

Note: The vulnerability requires an application to mark an event-handler attribute for translation with i18n-on*, and for an attacker to control or influence the translation file used at build or runtime. Applications that never mark event-handler attributes for translation, and that source translation files only from trusted origins, are not exposed to this vector.

‍

Steps To Reproduce

The advisory identifies the following vulnerable pattern, in which a static event-handler attribute is marked for translation:

<img src="foo.jpg" onerror="void 0" i18n-onerror />

A translation file for this element can then substitute the onerror attribute's value with attacker-controlled JavaScript. When the localized build renders the element, the injected script executes in the victim's browser.

‍

Mitigation

Angular versions 19.2.25 and earlier are End-of-Life and will not receive any updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Update to Angular v20.3.27, v21.2.19, or v22.0.1 (or later) within your current major version line.
• Migrate affected applications away from Angular versions that have reached End-of-Life.
• Leverage a commercial support partner like HeroDevs for post-EOL security support of Angular 19 and earlier.