← Vulnerability feed

Vulnerability record · CVE-2026-22610 · published 10 January 2026

CVE-2026-22610: Angular cross-site scripting vulnerability

Angular · Angular

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

8.5 CVSS 4.0 High EPSS 0.45% · top 63.8% CWE-79 · Cross-site scripting
8.5CVSS 4.0 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56 Patch
https://github.com/angular/angular/pull/66318 Issue Tracking
https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6 MitigationVendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
https://cert-portal.siemens.com/productcert/html/ssa-485750.html

Track CVE-2026-22610 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-68945Angular insufficient verification of data authenticity vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27,…EPSS 0.18%8.8CVE-2026-50168Angular origin validation error vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-r…EPSS 0.24%8.8CVE-2026-46417Angular server-side request forgery (ssrf) vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-n…EPSS 0.36%8.8CVE-2026-54266Angular insufficient verification of data authenticity vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, …EPSS 0.13%8.7CVE-2026-41423Angular server-side request forgery (ssrf) vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions…EPSS 0.48%8.6CVE-2026-69149Angular cross-site scripting vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27,…EPSS 0.35%8.6CVE-2026-50555Angular cross-site scripting vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-r…EPSS 0.27%8.6CVE-2026-50556Angular cross-site scripting vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-r…EPSS 0.41%

Source: NIST National Vulnerability Database (record CVE-2026-22610), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.