CVE-2026-69151: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 26% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AN

angular · angular

>= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; < 20.3.27 · source: vendor, NVD

CO

compiler · @angular

>= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; < 20.3.27 · source: vendor

CO

core · @angular

>= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; < 20.3.27 · source: vendor