PT-2026-22110 · Google · Angular

Punderwoman · Published 2026-02-26 · Updated 2026-03-04 · CVE-2026-27970

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Angular versions prior to 21.2.0 Angular versions prior to 21.1.16 Angular versions prior to 20.3.17 Angular versions prior to 19.2.19

Description Angular’s internationalization (i18n) pipeline contains a cross-site scripting issue. HTML within translated content, specifically in International Components for Unicode (ICU) messages, was not adequately sanitized, potentially allowing the execution of arbitrary JavaScript. The Angular i18n process involves extracting messages, translation, and merging translations back into the code. If a translation file (xliff, xtb, etc.) is compromised with malicious content, it could lead to the execution of attacker-controlled JavaScript within the application. Successful exploitation requires compromising the application’s translation file and the application must use Angular i18n, utilize ICU messages, and render these messages without adequate cross-site scripting defenses like a Content Security Policy.

Recommendations Angular versions prior to 21.2.0: Update to version 21.2.0 or later. Angular versions prior to 21.1.16: Update to version 21.1.16 or later. Angular versions prior to 20.3.17: Update to version 20.3.17 or later. Angular versions prior to 19.2.19: Update to version 19.2.19 or later. Review and verify translated content received from untrusted third parties before incorporating it into an Angular application. Enable strict Content Security Policy (CSP) controls to prevent unauthorized JavaScript execution. Enable Trusted Types to enforce proper HTML sanitization.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27970

GHSA-PRJF-86W9-MFQV

Affected Products

Angular

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27970.json · Exploit
• https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv · Vendor Advisory
• https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d · Patch
• https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232 · Patch
• https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93 · Patch
• https://github.com/angular/angular/pull/67183 · Patch
• https://osv.dev/vulnerability/CVE-2026-27970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27970 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-27970 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27970 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27970 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prjf-86w9-mfqv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27970 · Security Note
• https://ubuntu.com/security/CVE-2026-27970 · Vendor Advisory
• https://github.com/angular/angular · Note