PT-2026-25384 · Npm+4 · @Angular/Compiler+6

Highalan-Agius4 · Published 2026-03-13 · Updated 2026-05-12 · CVE-2026-32635

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-next.3 Angular versions prior to 21.2.4 Angular versions prior to 20.3.18 Angular versions prior to 19.2.20

Description A Cross-Site Scripting (XSS) issue exists in the Angular runtime and compiler. It occurs when an application uses a security-sensitive attribute combined with Angular's attribute internationalization capability. By adding the i18n-<attribute> name to a sensitive attribute, the framework's built-in sanitization mechanism is bypassed. When this is combined with data binding to untrusted user-generated data, an attacker can inject and execute malicious scripts in the user's browser, potentially leading to session hijacking, credential theft, and data exfiltration. Vulnerable attributes include action, background, cite, codebase, data, formaction, href, itemtype, longdesc, poster, src, and xlink:href.

Recommendations Update to version 22.0.0-next.3. Update to version 21.2.4. Update to version 20.3.18. Update to version 19.2.20. As a temporary workaround, ensure that any data bound to sensitive attributes is not sourced from untrusted user input or is not marked for internationalization. Alternatively, explicitly sanitize attributes by passing them through the DomSanitizer function.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32635

GHSA-G93W-MFHG-P222

Affected Products

@Angular/Compiler

@Angular/Core

Angular

Angularjs

Angular-Cli

Compiler

Core

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32635.json · Exploit
• https://github.com/angular/angular/pull/67541 · Patch
• https://github.com/angular/angular/pull/67561 · Patch
• https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32635 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32635 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32635 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g93w-mfhg-p222 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32635 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32635 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32635 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32635 · Security Note
• https://github.com/angular/angular · Note
• https://github.com/angular/angular/commit/8630319f74c9575a21693d875cc7d5252516146d · Note
• https://github.com/angular/angular/commit/78dea55351fb305b33a919c43a6b363137eca166 · Note