7.6
High
CVE-2026-69151 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| angular 22.0 | 22.0.0-next.0 → < 22.0.1 | 22.0.1 |
| angular 21.0 | 21.0.0-next.0 → < 21.2.19 | 21.2.19 |
| angular 20.3 | earliest → < 20.3.27 | 20.3.27 |
| compiler 22.0 | 22.0.0-next.0 → < 22.0.1 | 22.0.1 |
| compiler 21.0 | 21.0.0-next.0 → < 21.2.19 | 21.2.19 |
| compiler 20.3 | earliest → < 20.3.27 | 20.3.27 |
| core 22.0 | 22.0.0-next.0 → < 22.0.1 | 22.0.1 |
| core 21.0 | 21.0.0-next.0 → < 21.2.19 | 21.2.19 |
| core 20.3 | earliest → < 20.3.27 | 20.3.27 |
Other CVEs of angular
The 38 CVEs of angular →
CVE-2026-111753
Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
5.9
Medium
CVE-2026-111751
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
8.2
High
CVE-2026-111754
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
5.1
Medium
CVE-2026-111752
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
8.2
High