🎯Basically, a flaw in Angular lets bad actors inject harmful scripts into websites.
What Happened
A serious Cross-Site Scripting (XSS) vulnerability has been identified in the popular Angular framework. This flaw, tracked as CVE-2026-32635, affects key packages like @angular/compiler and @angular/core. The vulnerability arises from how Angular processes internationalization (i18n) for sensitive HTML attributes. While Angular typically sanitizes inputs to prevent code injection, this protection can be bypassed under specific conditions.
When developers enable internationalization for attributes like href or src, they may inadvertently expose their applications to attacks. If untrusted user data is bound to these attributes, attackers can inject malicious scripts, leading to severe consequences for users and applications alike.
Who's Affected
This vulnerability impacts countless enterprise and consumer web applications that rely on Angular. Given Angular's widespread usage, the potential attack surface is massive. Applications running vulnerable versions of Angular, particularly those binding unsanitized user input to sensitive attributes, are at risk. The affected versions include:
22.0.0-next.0
21.0.0-next.0
20.0.0-next.0
19.0.0-next.0
17.0.0-next.0
What Data Was Exposed
Exploiting this vulnerability can lead to various security risks, including:
Session Hijacking
Data Exfiltration
Unauthorized Actions
What You Should Do
To protect your applications, it's crucial to upgrade to a patched version of Angular as soon as possible. If immediate upgrades aren't feasible, developers should ensure that any data bound to vulnerable attributes originates only from trusted sources. Additionally, using Angular's DomSanitizer to manually sanitize inputs can help mitigate risks, even if the internationalization bypass occurs. By implementing these measures, developers can significantly reduce the likelihood of successful attacks.
🔒 Pro insight: The exploitation of this XSS vulnerability highlights the need for developers to rigorously validate and sanitize user inputs, especially in internationalized contexts.
