CVE-2026-69151

Name of the Vulnerable Software and Affected Versions Angular versions prior to 20.3.27 Angular versions prior to 21.2.19 Angular versions prior to 22.0.1

Description A Cross-Site Scripting (XSS) issue exists in the Angular compiler internationalization (i18n) pipeline. While standard attribute validation via validateAttribute() and validateProperty() prevents binding to event-handler attributes like onclick and onerror, the i18n metadata collection path allows these attributes to be marked for translation using i18n-on* attributes, such as i18n-onerror. This allows a lower-trust translation file to replace a static handler with arbitrary executable JavaScript in the localized build, potentially leading to session hijacking or unauthorized actions if an attacker controls the translation files.

Recommendations Update to version 20.3.27 or later. Update to version 21.2.19 or later. Update to version 22.0.1 or later. Ensure that static event-handler attributes are never marked for internationalization using i18n-on* in application templates. Ensure translation files are sourced from trusted origins.