GHSA-58w9-8g37-x9v5
NoneCVSS
—
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/compiler | 0 | No fix |
| npm | @angular/compiler | 20.0.0-next.0 | 20.3.25 |
| npm | @angular/compiler | 21.0.0-next.0 | 21.2.17 |
| npm | @angular/compiler | 22.0.0-next.0 | 22.0.1 |
Related vulnerabilities
- CVE-2026-54265 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-50557 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- GHSA-f3m7-gqxr-g87x Angular: Template and Attribute Namespace Sanitization Bypass (XSS) Also affects @angular/compiler
- CVE-2026-32635 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings Also affects @angular/compiler
- CVE-2026-22610 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- GHSA-jrmj-c5cx-3cw6 Angular has XSS Vulnerability via Unsanitized SVG Script Attributes Also affects @angular/compiler
- GHSA-v4hv-rgfq-gp49 Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes Also affects @angular/compiler