PT-2026-2230 · Google · Angular

Gkalpak + 1 · Published 2026-01-09 · Updated 2026-02-17 · CVE-2026-22610

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Angular versions prior to 19.2.18 Angular versions prior to 20.3.16 Angular versions prior to 21.0.7 Angular version 21.1.0-rc.0

Description Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. A cross-site scripting (XSS) issue exists in the Angular Template Compiler due to a failure in Angular’s internal sanitization schema to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This could potentially lead to arbitrary code execution.

Recommendations Update to Angular version 19.2.18 or later. Update to Angular version 20.3.16 or later. Update to Angular version 21.0.7 or later. Update to Angular version 21.1.0-rc.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22610

GHSA-JRMJ-C5CX-3CW6

Affected Products

Angular

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22610.json · Exploit
• https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6 · Vendor Advisory
• https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56 · Patch
• https://osv.dev/vulnerability/GHSA-jrmj-c5cx-3cw6 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22610 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22610 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22610 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-22610 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22610 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22610 · Vendor Advisory
• https://github.com/angular/angular · Note
• https://github.com/angular/angular/pull/66318 · Note
• https://t.me/CVEtracker/41913 · Telegram Post
• https://twitter.com/Komodosec/status/2023836436303409444 · Twitter Post