CVE-2026-22610: Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

Medium severity · published Jan 10, 2026

CVE-2026-22610

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

6.1

CVSS

0.4%

EPSS

On KEV

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 38% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

angular · angular

>= 21.1.0-next.0, < 21.1.0-rc.0; >= 21.0.0-next.0, < 21.0.7; >= 20.0.0-next.0, < 20.3.16; < 19.2.18 · source: vendor, NVD

RUGGEDCOM RST2428P · Siemens

before V4.0 · source: CISA

SIDIS Prime · Siemens

before V4.0.800 · source: CISA

In the news

VulnerabilityCritical

Siemens SIDIS Prime

View CSAF Summary SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version. The following versions of Siemens SIDIS Prime are affected: SIDIS Prime vers:intdot/<4.0.800 (CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-41996, CVE-2025-6965, CVE-2025-7783, CVE-2025-9230, CVE-2025-9232, CVE-2025-9670, CVE-2025-12816, CVE-2025-15284, CVE-2025-58751, CVE-2025-58752, CVE-2025-58754, CVE-2025-62522, CVE-2025-64718, CVE-2025-64756, CVE-2025-66030, CVE-2025-66031, CVE-2025-66035, CVE-2025-66412, CVE-2025-69277, CVE-2026-22610) CVSS Vendor Equipment Vulnerabilities v3 8.7 Siemens Siemens SIDIS Prime Out-of-bounds Read, Observable Discrepancy, Improper Input Validation, Improper Certificate Validation, Numeric Truncation Error, Use of Insufficiently Random Values, Out-of-bounds Write, Inefficient Regular Expression Complexity, Interpretation Conflict, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Relative Path Traversal, Allocation of Resources Without Limits or Throttling, Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Integer Overflow or Wraparound, Uncontrolled Recursio...

CVE-2024-29857 CVE-2024-30171 CVE-2024-30172

Mar 12, 2026·CISA Advisories

Affected product

angular

All angular CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-22610

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-22610

Patch

https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56