CVE-2026-32635

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
@angular	compiler	>= 22.0.0-next.0, < 22.0.0-next.3; >= 21.0.0-next.0, < 21.2.4; >= 20.0.0-next.0, < 20.3.18; >= 17.0.0.next.0, < 19.2.20
@angular	core	>= 22.0.0-next.0, < 22.0.0-next.3; >= 21.0.0-next.0, < 21.2.4; >= 20.0.0-next.0, < 20.3.18; >= 17.0.0.next.0, < 19.2.20

References

https://github.com/angular/angular/pull/67541Issue Tracking, Patch
https://github.com/angular/angular/pull/67561Issue Tracking, Patch
https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222Mitigation, Vendor Advisory

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-326367.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTr CVE-2026-326375.9Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1,CVE-2026-326382.7StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in S CVE-2026-326396.8Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Them CVE-2026-32648.8A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown CVE-2026-326409.8SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak danger CVE-2026-326417.5Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs use CVE-2026-326424.3Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire pro CVE-2026-326438.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager CVE-2026-326449.8Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.CVE-2026-326456.0Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.CVE-2026-326467.5A specific administrative endpoint is accessible without proper authentication, exposing device management functions.