8.5
High
CVE-2026-22610 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| angular 21.1 | 21.1.0-next.0 → < 21.1.0-rc.0 | 21.1.0-rc.0 |
| angular 21.0 | 21.0.0-next.0 → < 21.0.7 | 21.0.7 |
| angular 20.0 | 20.0.0-next.0 → < 20.3.16 | 20.3.16 |
| angular 19.2 | earliest → < 19.2.18 | 19.2.18 |
| RUGGEDCOM RST2428P 4.0 | earliest → < 4.0 | 4.0 |
| SIDIS Prime 4.0 | earliest → < 4.0.800 | 4.0.800 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of angular
The 38 CVEs of angular →
CVE-2026-111753
Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
5.9
Medium
CVE-2026-111751
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
8.2
High
CVE-2026-111754
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
5.1
Medium
CVE-2026-111752
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
8.2
High