GHSA-692r-grfm-v8x7
NoneCVSS
—
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/core | 0 | No fix |
| npm | @angular/core | 19.0.0-next.0 | 19.2.23 |
| npm | @angular/core | 20.0.0-next.0 | 20.3.22 |
| npm | @angular/core | 21.0.0-next.0 | 21.2.15 |
| npm | @angular/core | 22.0.0-next.0 | 22.0.0-rc.2 |
Related vulnerabilities
- CVE-2026-52725 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-54267 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/core
- CVE-2026-50557 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/core
- GHSA-f3m7-gqxr-g87x Angular: Template and Attribute Namespace Sanitization Bypass (XSS) Also affects @angular/core
- GHSA-rgjc-h3x7-9mwg Angular Client Hydration DOM Clobbering & Response-Cache Poisoning Also affects @angular/core
- CVE-2026-32635 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/core
- GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings Also affects @angular/core
- GHSA-prjf-86w9-mfqv Angular i18n vulnerable to Cross-Site Scripting Also affects @angular/core