Angular vulnerabilitiesAngular: known vulnerabilities and safe versions

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

• CVE-2026-880572026-09-10

  Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

  Affected versions: >= 22.0.0, < 22.1.0 · >= 21.0.0, < 21.2.20 · >= 20.0.0, < 20.3.28 · <= 19.2.25 · < 19.2.26

  medium 5.3

  Fixed in: 19.2.26, 20.3.28, 21.2.20, 22.1.0

• CVE-2026-691512026-08-03

  Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

  Affected versions: >= 22.0.0-next.0, < 22.0.1 · >= 21.0.0-next.0, < 21.2.19 · >= 20.0.0-next.0, < 20.3.27 · <= 19.2.25

  high 7.6

  Fixed in: 20.3.27, 21.2.19, 22.0.1

• CVE-2026-542672026-06-22

  Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

  Affected versions: >= 22.0.0-next.0, < 22.0.1 · >= 21.0.0-next.0, < 21.2.17 · >= 20.0.0-next.0, < 20.3.25 · <= 19.2.25 · < 19.2.26

  high 8.6

  Fixed in: 19.2.26, 20.3.25, 21.2.17, 22.0.1

• CVE-2026-527252026-06-22

  Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

  Affected versions: >= 21.0.0-next.0, < 21.2.15 · >= 22.0.0-next.0, < 22.0.0-rc.2 · >= 19.0.0-next.0, < 19.2.23 · <= 18.2.14 · >= 20.0.0-next.0, < 20.3.22 · < 18.2.15

  medium 5.3

  Fixed in: 18.2.15, 19.2.23, 20.3.22, 21.2.15

• CVE-2026-505572026-06-22

  Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

  Affected versions: >= 21.0.0-next.0, < 21.2.15 · >= 22.0.0-next.0, < 22.0.0-rc.2 · >= 20.0.0-next.0, < 20.3.22 · >= 19.0.0-next.0, < 19.2.22 · <= 18.2.14 · < 18.2.15

  medium 5.3

  Fixed in: 18.2.15, 19.2.22, 20.3.22, 21.2.15

• CVE-2026-32635exploit code exists2026-03-16

  Angular has XSS in i18n attribute bindings

  Affected versions: >= 22.0.0-next.0, < 22.0.0-next.3 · >= 21.0.0-next.0, < 21.2.4 · >= 20.0.0-next.0.0.0, < 20.3.18 · >= 19.0.0-next.0, < 19.2.20 · >= 17.0.0-next.0, <= 18.2.14 · >= 17.0.0-next.0, < 18.2.15

  high 8.6

  Fixed in: 18.2.15, 19.2.20, 20.3.18, 21.2.4

• CVE-2026-279702026-02-25

  Angular i18n vulnerable to Cross-Site Scripting (XSS)

  Affected versions: >= 21.2.0-next.0, < 21.2.0 · >= 21.0.0-next.0, < 21.1.6 · >= 20.0.0-next.0, < 20.3.17 · >= 19.0.0-next.0, < 19.2.19 · <= 18.2.14 · < 18.2.15

  high 7.6

  Fixed in: 18.2.15, 19.2.19, 20.3.17, 21.1.6

• CVE-2026-22610exploit code exists2026-01-10

  Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

  Affected versions: >= 21.1.0-next.0, < 21.1.0-rc.0 · >= 21.0.0-next.0, < 21.0.7 · >= 20.0.0-next.0, < 20.3.16 · >= 19.0.0-next.0, < 19.2.18 · <= 18.2.14

  high 8.5

  Fixed in: 19.2.18, 20.3.16, 21.0.7

• CVE-2021-42312022-05-26

  Angular Comment cross site scripting

  Affected versions: >= 11.0.0, < 11.0.5 · >= 11.1.0-next.0, < 11.1.0-next.3 · < 10.2.5

  medium 5.4

  Fixed in: 10.2.5, 11.0.5

  EPSS 1.1%