High
Angular has XSS in i18n attribute bindings
Type: advisorySources: OSV
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n- name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-32635
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 10:27 UTC · Revision 1
Source evidence
Angular has XSS in i18n attribute bindings
core-osv · Original sourcePublished 13 Mar 2026, 20:58 UTC
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n- name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
osv:CVE-2026-32635
Complete source record
{
"id": "c30313e701fd1f29066e55598a53d9a066a07b8785759cf21cc04bd4f8360b9d",
"url": "https://osv.dev/vulnerability/CVE-2026-32635",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Angular has XSS in i18n attribute bindings",
"summary": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n- name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.",
"evidence": "osv:CVE-2026-32635",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-32635",
"aliases": [
"CVE-2026-32635",
"GHSA-g93w-mfhg-p222"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/angular/angular",
"type": "GIT",
"events": [
{
"introduced": "62676269d207db80576052d080b756e938be97ea"
},
{
"fixed": "4cbc1a1d87e2b2a5d9447bb74ca26bc2d83f16ec"
},
{
"introduced": "a0ee6bdfe4102357dd231bcf02f5ff4d44fb585c"
},
{
"fixed": "525e1605a6b3ca634a98fda080bd0b3d236f4513"
},
{
"introduced": "ab2ee22c3d1a80b7ffe2c74c988dbd2503305b70"
},
{
"fixed": "cef3164f97c3b9308d3d9b9893e1487558696f5a"
},
{
"introduced": "77504f18afd4ff0bacf35599ab4f85892cc92048"
},
{
"fixed": "2c51d98dd4ed3cc0ad427e2e2b26f3434785ae19"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "22.0.0-next.0"
},
{
"fixed": "22.0.0-next.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "21.0.0-next.0"
},
{
"fixed": "21.2.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "20.0.0-next.0"
},
{
"fixed": "20.3.18"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "17.0.0.next.0"
},
{
"fixed": "19.2.20"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
},
{
"repo": "https://github.com/angular/angular-cli",
"type": "GIT",
"events": [
{
"introduced": "0bd9a81e977ae3ca8f01dc33931ee0ad3434bd28"
},
{
"fixed": "aaa1acce150ba83ea8856ec11f3a4486f424bcb8"
},
{
"introduced": "510db3e93f6aa8daccc80dd0fcbc4dd0c3a3fcec"
},
{
"last_affected": "05b35113e680341f9f9465b0f35d93fd663ba59f"
},
{
"introduced": "a06ccb3f5f20364bfd0ff47269ac63824652d118"
},
{
"fixed": "2aa93fc30918535abe2698bef8984aae57f6c115"
},
{
"introduced": "93b1debc57ff7298be616469cdefe94f215c43be"
},
{
"last_affected": "174c7860b212d2f4f78ad7275e5e33f0f17487fd"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:angular:angular_cli:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "17.0.0"
},
{
"fixed": "19.2.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:angular:angular_cli:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "20.0.0"
},
{
"last_affected": "20.3.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:angular:angular_cli:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "21.0.0"
},
{
"fixed": "21.2.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:angular:angular_cli:22.0.0:next0:*:*:*:*:*:*",
"range": [
{
"introduced": "22.0.0-next0"
},
{
"last_affected": "22.0.0-next0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:angular:angular_cli:22.0.0:next1:*:*:*:*:*:*",
"range": [
{
"introduced": "22.0.0-next1"
},
{
"last_affected": "22.0.0-next1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"22.0.0-next0",
"22.0.0-next1",
"v21.2.14",
"v21.2.13",
"v21.2.12",
"v21.2.11",
"v21.2.10",
"v21.2.9",
"v21.2.8",
"v21.2.7",
"v21.2.6",
"v21.2.5",
"v21.2.4",
"v19.2.19",
"v20.3.17",
"vsix-21.2.3",
"v22.0.0-next.2",
"v21.2.3",
"v21.2.2",
"v22.0.0-next.1",
"vsix-21.2.2",
"v22.0.0-next.0",
"v21.2.1",
"vsix-21.2.1",
"v21.2.0",
"v19.2.18",
"v20.3.16",
"vsix-21.2.0",
"v21.2.0-rc.0",
"v21.2.0-next.3",
"v21.2.0-next.2",
"v21.2.0-next.1",
"v21.2.0-next.0",
"20.3.15",
"19.2.17",
"v21.1.0-next.4",
"v21.1.0-next.3",
"v21.1.0-next.2",
"21.1.0-next.1",
"20.3.14",
"19.2.16",
"21.1.0-next.0",
"20.3.13",
"zone.js-0.16.0",
"20.3.12",
"20.3.11",
"20.3.10",
"20.3.9",
"20.3.8",
"20.3.7",
"20.3.6",
"20.3.5",
"21.0.0-next.8",
"20.3.4",
"21.0.0-next.7",
"20.3.3",
"21.0.0-next.6",
"20.3.2",
"21.0.0-next.5",
"20.3.1",
"21.0.0-next.4",
"19.2.15",
"20.3.0",
"21.0.0-next.3",
"20.3.0-rc.0",
"21.0.0-next.2",
"20.2.4",
"20.2.3",
"20.2.2",
"21.0.0-next.1",
"20.2.1",
"20.2.0",
"21.0.0-next.0",
"20.2.0-rc.1",
"20.2.0-rc.0",
"20.2.0-next.6",
"20.2.0-next.5",
"20.2.0-next.4",
"20.2.0-next.3",
"20.2.0-next.2",
"20.2.0-next.1",
"20.2.0-next.0",
"20.1.0-next.3",
"20.1.0-next.2",
"20.1.0-next.1",
"20.1.0-next.0",
"19.2.14",
"19.2.13",
"zone.js-0.15.1",
"19.2.12",
"19.2.11",
"19.2.10",
"19.2.9",
"19.2.8",
"20.0.0-next.8",
"19.2.7",
"20.0.0-next.7",
"19.2.6",
"20.0.0-next.6",
"19.2.5",
"20.0.0-next.5",
"19.2.4",
"20.0.0-next.4",
"19.2.3",
"20.0.0-next.3",
"19.2.2",
"20.0.0-next.2",
"19.2.1",
"20.0.0-next.1",
"20.0.0-next.0",
"19.2.0",
"19.2.0-rc.0",
"19.2.0-next.3",
"19.2.0-next.2",
"19.2.0-next.1",
"19.2.0-next.0",
"19.1.0-next.4",
"19.1.0-next.3",
"19.1.0-next.2",
"19.1.0-next.1",
"19.1.0-next.0",
"19.0.0-next.10",
"19.0.0-next.9",
"19.0.0-next.8",
"19.0.0-next.7",
"19.0.0-next.6",
"19.0.0-next.5",
"19.0.0-next.4",
"19.0.0-next.3",
"19.0.0-next.2",
"19.0.0-next.1",
"zone.js-0.15.0",
"19.0.0-next.0",
"18.2.0-next.4",
"zone.js-0.14.10",
"18.2.0-next.3",
"18.2.0-next.2",
"zone.js-0.14.8",
"18.2.0-next.1",
"18.2.0-next.0",
"18.1.0-next.4",
"18.1.0-next.3",
"18.1.0-next.2",
"zone.js-0.14.7",
"18.1.0-next.1",
"18.1.0-next.0",
"zone.js-0.14.6",
"zone.js-0.14.5",
"18.0.0-next.5",
"18.0.0-next.4",
"18.0.0-next.3",
"18.0.0-next.2",
"18.0.0-next.1",
"18.0.0-next.0",
"17.3.0-next.1",
"17.3.0-next.0",
"zone.js-0.14.4",
"17.2.0-next.1",
"17.2.0-next.0",
"zone.js-0.14.3",
"17.1.0-next.5",
"17.1.0-next.4",
"17.1.0-next.3",
"17.1.0-next.2",
"17.1.0-next.1",
"17.1.0-next.0",
"zone.js-0.14.2",
"zone.js-0.14.1",
"17.0.0-next.7",
"17.0.0-next.6",
"17.0.0-next.5",
"zone.js-0.14.0",
"17.0.0-next.4",
"zone.js-0.13.3",
"zone.js-0.13.2",
"17.0.0-next.3",
"17.0.0-next.2",
"17.0.0-next.1",
"17.0.0-next.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32635.json"
}
}
],
"modified": "2026-10-28T02:30:27.937236047Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32635.json",
"https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222",
"https://nvd.nist.gov/vuln/detail/CVE-2026-32635",
"https://github.com/angular/angular/pull/67541",
"https://github.com/angular/angular/pull/67561"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32635.json"
}
},
"related_cves": [
{
"value": "CVE-2026-32635",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 494534,
"published_at": "2026-03-13T20:58:12.554+00:00"
}