CVE-2026-88057

Overview

Angular is a TypeScript-based web development platform for building scalable single-page and server-side rendered applications. It provides a modular architecture, powerful dependency injection, and built-in tools for building modern, performant, and maintainable applications across web, mobile, and desktop environments.

A Cross-Site Scripting (XSS) vulnerability (CVE-2026-88057) has been identified in Angular's Template Compiler and Core, which allows attackers to bypass host binding sanitization when a directive's host bindings are applied to an element that does not match its selector, such as through host directives, directive inheritance, or components created dynamically onto an existing host element, and can lead to arbitrary JavaScript execution within the context of the victim's browser session.

Per OWASP: this vulnerability falls under Stored Cross-Site Scripting. Stored XSS occurs when an application stores untrusted input and later renders it without proper neutralization. In this case, the injected payload may execute when a user interacts with the affected element or automatically when an animation is triggered.

This issue affects multiple versions of Angular.

‍

Details

Module Info

• Product: Angular
• Affected packages: @angular/compiler, @angular/core
• Affected versions:
  • <=19.2.25
  • >=20.0.0 <20.3.28
  • >=21.0.0 <21.2.20
  • >=22.0.0, <22.1.0
• GitHub repository: https://github.com/angular/angular
• Published packages:
• https://www.npmjs.com/package/@angular/compiler
• https://www.npmjs.com/package/@angular/core
• Package manager: npm
• Fixed in:
  • OSS Angular v20.3.28, v21.2.20 and v22.1.0

Vulnerability Info

This Medium-severity vulnerability is found in the @angular/compiler and @angular/core packages in multiple published versions of Angular.

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS). Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.

When a directive with a security-sensitive host binding was applied to a different concrete host element, such as through hostDirectives composition, class inheritance of host bindings, dynamic component instantiation (createComponent with a custom hostElement or dynamic directives), elements with SVG/MathML namespaces such as <svg:a> and <math>, or elements using tag-neutral selectors such as :not(...), the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs such as javascript:... URLs bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.

An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context, resulting in Cross-Site Scripting.

‍

Mitigation

Angular versions prior to 20 were already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Migrate affected applications to a patched version of Angular.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.