High 8.6Published Mar 13, 2026

CVE-2026-32635Angular has XSS in i18n attribute bindings

Updated under an hour ago (Oct 26, 2026, 1:00 PM ET)

Does this affect you?

It affects @angular compiler and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for @angular compiler

Exploited in the last 30 days

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

CVSS: 8.6 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Mar 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

@angular compiler angular:compiler (from the name)	from 22.0.0-next.0, < 22.0.0-next.3; from 21.0.0-next.0, < 21.2.4; from 20.0.0-next.0, < 20.3.18; from 17.0.0.next.0, < 19.2.20	CNA record
@angular core angular:core (from the name)	from 22.0.0-next.0, < 22.0.0-next.3; from 21.0.0-next.0, < 21.2.4; from 20.0.0-next.0, < 20.3.18; from 17.0.0.next.0, < 19.2.20	CNA record
angular angular_cli angular:angular_cli	from 17.0.0 before 19.2.0; from 20.0.0 through 20.3.18; from 21.0.0 before 21.2.4; 22.0.0; 22.0.0	NVD

References

References

https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222	x-refsource-confirm, mitigation, vendor-advisory
https://github.com/angular/angular/pull/67541	x-refsource-misc, issue-tracking, patch
https://github.com/angular/angular/pull/67561	x-refsource-misc, issue-tracking, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.