CVE-2026-22610

About vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.

In a standard security model, attributes that can load and execute code (like a script’s source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular’s built-in security protections.

When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.

Impact

When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim’s browser session. This can lead to:

• Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
• Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
• Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.

Attack Preconditions

1. The victim application must explicitly use SVG <script> elements within its templates.
2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).

Patches

• 19.2.18
• 20.3.16
• 21.0.7
• 21.1.0-rc.0

Workarounds

Until the patch is applied, developers should:

• Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
• Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.

Resources

• https://github.com/angular/angular/pull/66318

Affected product:

Angular , AngularJS , TanStack/table , ag-charts , ag-grid , ai-sdk-angular , analog , analogjs-astro-angular , analogjs-router , analogjs-storybook-angular , analogjs-vite-plugin-angular , angular-animations , angular-build , angular-cdk-experimental , angular-common , angular-compiler , angular-compiler-cli , angular-components , angular-core , angular-create , angular-devkit-build-angular , angular-devkit-core , angular-devkit-schematics-cli , angular-elements , angular-estree-parser , angular-forms , angular-localize , angular-material-date-fns-adapter , angular-material-experimental , angular-material-luxon-adapter , angular-material-moment-adapter , angular-platform-browser , angular-platform-browser-dynamic , angular-platform-server , angular-pwa , angular-router , angular-service-worker , angular-ssr , angular-upgrade , angular-youtube-player , angular/components , bugsnag-plugin-angular , fullcalendar-angular , intl-tel-input-angular , jest-preset-angular , langchain-angular , lucide , ng-mocks , ng-packagr , ng2-charts , ngrx-component , ngrx-component-store , ngrx-effects , ngrx-entity , ngrx-router-store , ngrx-signals , ngrx-store , ngrx-store-devtools , ngtools-webpack , nguniversal , nguniversal-common , ngx-translate-core , nx-angular-rspack , nx-angular-rspack-compiler , openuidev-angular-lang , query , sb , schematics-angular , sentry-angular , sentry-astro , sentry-deno , sentry-ember , sentry-gatsby , sentry-javascript , sentry-replay , sentry-wasm , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-themes , storybook-angular , storybook-angular-vite , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , tabler-icons-angular , tanstack-ai-angular , tanstack-angular-db , tanstack-angular-devtools , tanstack-angular-form , tanstack-angular-hotkeys , tanstack-angular-hotkeys-devtools , tanstack-angular-pacer , tanstack-angular-pacer-devtools , tanstack-angular-query-experimental , tanstack-angular-store , tanstack-angular-table , tanstack-angular-table-devtools , tanstack-angular-virtual , tanstack-devtools-utils , tanstack-hotkeys-devtools , tanstack-pacer-devtools , trycourier-courier-angular , unhead-angular , uppy

Affected packages:

angular (+3406 more)