CVE-2026-69151— Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| @angular | compiler | >= 22.0.0-next.0, < 22.0.1 | affected |
>= 21.0.0-next.0, < 21.2.19 | affected | ||
< 20.3.27 | affected | ||
| @angular | core | >= 22.0.0-next.0, < 22.0.1 | affected |
>= 21.0.0-next.0, < 21.2.19 | affected | ||
< 20.3.27 | affected | ||
| angular | angular | >= 22.0.0-next.0, < 22.0.1 | affected |
>= 21.0.0-next.0, < 21.2.19 | affected | ||
< 20.3.27 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-69151
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Source: CVE Program / CVE List V5
Vulnerability Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69151
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-69151
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69151 (3)
Vendor Advisories for CVE-2026-69151 (1)
Same Patch Batch · angular · 2026-08-03 · 3 CVEs total
| CVE-2026-68945 | 8.8 HIGH | Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse |
| CVE-2026-69149 | 8.6 HIGH | Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scrip |
IV. Related Vulnerabilities
Same product: angular
- CVE-2026-69149
Angular SSR: Missing Fallback Raw-Content Serialization Esca - CVE-2026-68945
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to - CVE-2026-50171
Angular: Denial of Service (DoS) via OOM in Number Formattin - CVE-2026-50184
Angular: Request Credential & Cache Policy Stripping in Angu - CVE-2026-50169
Angular Service Worker Policy-Bypass & Credential-Stripping
Same vendor: angular
- CVE-2026-69149
Angular SSR: Missing Fallback Raw-Content Serialization Esca - CVE-2026-68945
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to - CVE-2026-50171
Angular: Denial of Service (DoS) via OOM in Number Formattin - CVE-2026-50184
Angular: Request Credential & Cache Policy Stripping in Angu - CVE-2026-50169
Angular Service Worker Policy-Bypass & Credential-Stripping
Same weakness: CWE-79
- CVE-2026-70588
Ghost: Cross-Site Scripting in Universal Import - CVE-2026-70492
Open WebUI: Stored XSS via unescaped KaTeX render-error fall - CVE-2026-65986
CVAT has stored XSS via annotation guide assets - CVE-2026-70486
Open WebUI: Same-origin XSS to account takeover via terminal - CVE-2026-66300
SNOMED International Snowstorm reflected XSS
V. Comments for CVE-2026-69151
No comments yet