Skip to content

Update dependency @angular/compiler to v21.2.20 [SECURITY] - #77

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-angular-compiler-vulnerability
Open

Update dependency @angular/compiler to v21.2.20 [SECURITY]#77
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-angular-compiler-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Mar 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@angular/compiler (source) 21.1.4 → 21.2.20 age confidence

Angular vulnerable to XSS in i18n attribute bindings

CVE-2026-32635 / GHSA-g93w-mfhg-p222

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.

The following example illustrates the issue:

<a href="" i18n-href>Click me</a>

The following attributes have been confirmed to be vulnerable:

  • action
  • background
  • cite
  • codebase
  • data
  • formaction
  • href
  • itemtype
  • longdesc
  • poster
  • src
  • xlink:href
Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

  • Session Hijacking: Stealing session cookies and authentication tokens.
  • Data Exfiltration: Capturing and transmitting sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the user.
Attack Preconditions
  1. The application must use a vulnerable version of Angular.
  2. The application must bind unsanitized user input to one of the attributes mentioned above.
  3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.
Patches
  • 22.0.0-next.3
  • 21.2.4
  • 20.3.18
  • 19.2.20
Workarounds

The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.

Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:

import {Component, inject, SecurityContext} from '@angular/core';
import {DomSanitizer} from '@angular/platform-browser';

@Component({
  template: `
    <form action="" i18n-action>
      <button>Submit</button>
    </form>
  `,
})
export class App {
  url: string;

  constructor() {
    const dangerousUrl = 'javascript:alert(1)';
    const sanitizer = inject(DomSanitizer);
    this.url = sanitizer.sanitize(SecurityContext.URL, dangerousUrl) || '';
  }
}
References

Severity

  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@​angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

CVE-2026-54265 / GHSA-58w9-8g37-x9v5

More information

Details

An issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings.

Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized.

This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that uses two-way data binding ([()] or bindon-) on security-sensitive native DOM properties (like innerHTML, href on <a>, src on <img>/<iframe>, etc.) is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to supply an unsanitized property binding value that bypasses core sanitization constraints. This could lead to the execution of arbitrary JavaScript within the target user's browser context, potentially resulting in session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit this vulnerability, the following environment parameters and application states must concurrently exist:

  1. Two-Way Binding on Sensitive Properties: The application must bind to a sensitive native DOM property using the two-way binding syntax (e.g., <div [(innerHTML)]="userContent"></div>).
  2. User-Controlled Input: The value bound to this property must be influenceable by user-controlled input.
  3. Absence of Additional Sanitization: The application does not perform separate manual sanitization (e.g., via DomSanitizer) before passing the value to the bound property.
Patches
  • 22.0.1
  • 21.2.17
  • 20.3.25

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

CVE-2026-50557 / GHSA-f3m7-gqxr-g87x

More information

Details

An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.

Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.

Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.

Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:

  1. User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
  2. Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
  3. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.
Patches
  • 22.0.0-rc.2
  • 21.2.15
  • 20.3.22
  • 19.2.23

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

CVE-2026-69151 / GHSA-jj27-h5hq-8x99

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).

When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.

The following example illustrates a vulnerable pattern:

<img src="foo.jpg" onerror="void 0" i18n-onerror />
Impact

When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to:

  • Session Hijacking: Accessing session cookies, tokens, or sensitive user data.
  • Unauthorized Actions: Performing actions on behalf of the authenticated user.
Patched Versions
  • 22.0.1
  • 21.2.19
  • 20.3.27
Workarounds

Ensure that static event-handler attributes (e.g., onerror, onclick) are never marked for internationalization (i18n-on*) in application templates, and ensure translation files are sourced from trusted origins.

Severity

  • CVSS Score: 7.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler

CVE-2026-88057 / GHSA-hh8m-fm6v-7cvg

More information

Details

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS).

Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.

When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:

  • hostDirectives composition,
  • Class inheritance of host bindings,
  • Dynamic component instantiation (createComponent with custom hostElement or dynamic directives),
  • Elements with SVG/MathML namespaces (e.g. <svg:a>, <math>), or
  • Elements using tag-neutral selectors (e.g. :not(...)),

the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. javascript:... URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.

Impact

An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).

Patches

This issue has been resolved in versions:

  • 22.1.0
  • 21.2.20
  • 20.3.28
Workarounds

Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict the input to validated safe URL schemes (e.g. http://, https://).

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@​angular/compiler)

v21.2.20

Compare Source

core
Commit Type Description
6afe6fa781 fix sanitize host bindings on concrete hosts
http
Commit Type Description
fec5977df4 fix match header values exactly when deleting
e33d69a71c fix preserve immutability of materialized clones
caf616670f fix run root interceptors in the terminal request chain

v21.2.19

Compare Source

compiler
Commit Type Description
e2660c3dee fix disallow i18n event attributes
7b884f585a fix restrict possible event handler check to property names longer than 2 characters
http
Commit Type Description
948a8d6831 fix distinguish repeated transfer cache params
9949dccce1 fix enable xsrf for root-provided HttpClient
platform-server
Commit Type Description
f34a93c946 fix update domino to latest version

v21.2.18

Compare Source

compiler-cli
Commit Type Description
8d22cc953b fix update babel dependencies to latest v7
core
Commit Type Description
6bcce117fb fix avoid caching missing locale data
5a693bafcd fix reject dynamic script host elements
http
Commit Type Description
91df739b80 fix prevent caching of responses with Set-Cookie headers
service-worker
Commit Type Description
1804f73bec fix preserve referrer in asset requests
e86c31bf26 fix preserve referrer policy in asset requests

v21.2.17

Compare Source

Deprecations

platform-server
  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.
common
Commit Type Description
86a56dc279 fix Limits date format string length
d846326b07 fix skip transfer cache for uncacheable HTTP traffic
bc55749698 fix use cryptographically secure SHA-256 for transfer cache key generation
compiler
Commit Type Description
dc9c99636d fix sanitize two-way properties
core
Commit Type Description
1523061137 fix harden TransferState restoration against DOM clobbering
88832c84f8 fix validate lowercase SVG animation attribute names (#​69269)
http
Commit Type Description
bcb1b7ea25 fix preserve empty referrer option in HttpRequest
a810a319d1 fix Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d fix skip transfer cache for fetch credentialed requests
platform-server
Commit Type Description
35510746b7 fix harden platform location origin validation during SSR
13fb0afe93 refactor deprecate ServerXhr (#​69255)
service-worker
Commit Type Description
b9d29381bb fix Strips sensitive headers on cross-origin redirects

v21.2.16

Compare Source

common
Commit Type Description
f6d8e642b0 fix only strip a literal /index.html suffix from URLs
compiler
Commit Type Description
ae1c8a1f7a fix move projection attributes into constants
core
Commit Type Description
3fd6897a67 fix harden inherit definition feature against polluted prototypes
7e38336dc7 fix use Object.create(null) for LOCALE_DATA as a hardening measure
platform-server
Commit Type Description
66821c4ed5 fix throw on suspicious URLs and restrict protocol-relative URLs
d3170031b6 fix update domino to latest version

v21.2.15

Compare Source

common
Commit Type Description
7f4ac78994 fix add upper bounds for digitsInfo
300f61feb3 fix sanitize placeholder
compiler
Commit Type Description
0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#​68925)
eb1cbbf2eb fix prevent namespaced SVG <style> elements from being stripped
cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#​68925)
782e01594e fix strip namespaced SVG script elements during template compilation (#​68925)
core
Commit Type Description
ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#​68925)
e6fe77cc97 fix sanitize meta selectors
daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#​68925)
dada86e43d fix synchronize core sanitization schema with compiler (#​68925)
http
Commit Type Description
582a417bd2 fix exclude withCredentials requests from transfer cache
5c6d6df34b fix skip TransferCache for cookie-bearing requests by default
platform-server
Commit Type Description
37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e fix secure location and document initialization against SSRF and path hijack
service-worker
Commit Type Description
b8bd49341d fix Preserves explicit 'credentials: omit' in asset requests
ca32fc1000 fix Preserves HTTP cache mode in asset group requests

v21.2.14

Compare Source

compiler
Commit Type Description
68282dff9f fix strip namespaced SVG script elements during template compilation
core
Commit Type Description
c0f52272ed fix do not insert todo when migrating void @​Output
938a7f3edd fix makes resource URL sanitizer lookup case-insensitive
0fb2724194 fix reject script element as a dynamic component host
49113ac0ef fix visit ICU expressions in signal migration schematics
router
Commit Type Description
099bf577ee fix skip scroll-to-top on initial navigation when hydrating

v21.2.13

Compare Source

core
Commit Type Description
1c6553e97d fix disallow event attribute bindings in host bindings unconditionally
platform-server
Commit Type Description
629905d537 fix add allowedHosts option to renderModule and renderApplication
0b7192f441 fix forward BEFORE_APP_SERIALIZED errors to ErrorHandler

v21.2.12

Compare Source

core
Commit Type Description
fe13bb669d fix allow explicit read generic with signal input transforms
3430251fef fix i18n flags leaking on errors
1aeebbe304 fix respect ngSkipHydration on components with projectable nodes in LContainers
9e38ed7d57 fix sanitizer typings
7a05a9a71a fix validate security-sensitive attributes in i18n bindings
c37f6ca42f fix visit ng-let expression value in signal migration schematics
forms
Commit Type Description
03ad53863b fix prohibit concurrent submits in signal forms

v21.2.11

Compare Source

common
Commit Type Description
10ad3c0692 fix prevent focus from scrollToAnchor
compiler
Commit Type Description
4f5d8a2c0b fix let declaration span not including end character
core
Commit Type Description
a40e2cebc8 fix fix ordering of view queries metadata in JIT mode
885a1a1d97 fix guard against non-object events and avoid listener wrapper identity mismatch
7a64aff9b5 fix prevent event replay double-invocation when element hydrates before app stability
platform-server
Commit Type Description
be1f80a253 fix ensure origin has a trailing slash when parsing url

v21.2.10

Compare Source

docs
Commit Type Description
0d5ee9ae1b fix link formatting in "Animating your Application with CSS"
migrations
Commit Type Description
5533ab4f56 fix fix NgClass leaving trailing comma after removal
router
Commit Type Description
580212c995 fix restore internal URL on popstate when browserUrl is used

v21.2.9

Compare Source

core
Commit Type Description
f603d4714f fix escape forward slashes in transfer state to prevent crawler indexing
http
Commit Type Description
540536c386 fix add CSP nonce support to JsonpClientBackend
63a857b874 fix Don't on Passthru outside of reactive context
platform-server
Commit Type Description
e0b5078cf2 fix prevent SSRF bypasses via protocol-relative and backslash URLs
router
Commit Type Description
684e9fd53d fix normalize multiple leading slashes in URL parser

v21.2.8

Compare Source

compiler
Commit Type Description
e40d378f3e fix handle nested brackets in host object bindings
compiler-cli
Commit Type Description
2c6781071f fix error for type parameter declarations
core
Commit Type Description
82192deda9 fix handle missing serialized container hydration data
057cc6d09d fix remove obsolete iOS cursor pointer hack in event delegation
language-service
Commit Type Description
7797671257 fix get quick info at local var location to align with TS semantics and support type narrowing

v21.2.7

Compare Source

compiler
Commit Type Description
fea25d1a60 fix register SVG animation attributes in URL security context (#​67797)
compiler-cli
Commit Type Description
bba5ed8e64 fix prevent recursive scope checks for invalid NgModule imports
core
Commit Type Description
d04ddd73df fix prevent binding unsafe attributes on SVG animation elements (#​67797)
[8fd896e99a](https://redirect.github.com/angular/angular/commit/8fd896e99a13855c6569f29efe7e

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Mar 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Client/package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: module-management-client@0.0.1
npm error Found: @angular/compiler@21.2.20
npm error node_modules/@angular/compiler
npm error   dev @angular/compiler@"21.2.20" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/compiler@"21.1.4" from @angular/platform-browser-dynamic@21.1.4
npm error node_modules/@angular/platform-browser-dynamic
npm error   @angular/platform-browser-dynamic@"21.1.4" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-16T19_26_46_426Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-16T19_26_46_426Z-debug-0.log

@renovate renovate Bot changed the title Update dependency @angular/compiler to v21.2.4 [SECURITY] Update dependency @angular/compiler to v21.2.4 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/npm-angular-compiler-vulnerability branch March 27, 2026 05:05
@renovate renovate Bot changed the title Update dependency @angular/compiler to v21.2.4 [SECURITY] - autoclosed Update dependency @angular/compiler to v21.2.4 [SECURITY] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from e05ff01 to 1d40203 Compare March 30, 2026 17:32
@renovate
renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from 1d40203 to ba250da Compare May 2, 2026 18:15
@renovate
renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from ba250da to e3df376 Compare August 26, 2026 17:10
@renovate renovate Bot changed the title Update dependency @angular/compiler to v21.2.4 [SECURITY] Update dependency @angular/compiler to v21.2.19 [SECURITY] Aug 26, 2026
@renovate
renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from ba250da to e3df376 Compare August 26, 2026 17:11
@renovate
renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from e3df376 to 506384e Compare September 11, 2026 13:54
@renovate renovate Bot changed the title Update dependency @angular/compiler to v21.2.19 [SECURITY] Update dependency @angular/compiler to v21.2.20 [SECURITY] Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants