CVE-2026-69151CWE-79cross-site-scripting

CVE-2026-69151

Medium · published August 3, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-03T21:16Z
Affected products (4)
ProductVersionsFixed in
angular/angular≤ 19.2.25—
angular/angular≥ 20.0.0, < 20.3.2720.3.27
angular/angular≥ 21.0.0, < 21.2.1921.2.19
angular/angular≥ 22.0.0, < 22.0.122.0.1
References (5)
https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e · [email protected]https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865 · [email protected]https://github.com/angular/angular/pull/68821 · [email protected]https://github.com/angular/angular/pull/69306 · [email protected]https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99 · [email protected]
EPSS history
Timeline
  • 03 AUG 16:23Z
    Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
    cvelistv5