Intel

CVE-2026-69151

angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2026-69151)

highEPSS 0.2%

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

Source: NVDCVEORGBSI_CSAFBSIOSVCVELISTV5

Metrics

Severity
high
Priority score
83.22
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.6
Source: nvd-v4
CVSS v3
6.1
CVSS v4
7.6
EPSS percentile
9.8 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-03 17:16 UTC
CWE
CWE-79

Weakness classes (CWE)

  • CWE-79Base

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-08-11 18:19 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    • CPE Configuration: OR *cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* versions up to (including) 19.2.25 *cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* versions from (including) 22.0.0 up to (excluding) 22.0.1 *cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* versions from (including) 20.0.0 up to (excluding) 20.3.27 *cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* versions from (including) 21.0.0 up to (excluding) 21.2.19
    • Reference Type: GitHub, Inc.: https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e Types: Patch
    • Reference Type: GitHub, Inc.: https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865 Types: Patch
  2. CVE Modified2026-08-03 22:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-69151","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  3. New CVE Received2026-08-03 17:16 UTC· security-advisories@github.com
    • Affected: angular, compiler, core
    • Description: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
    • CVSS V4.0: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    • CWE: CWE-79

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • angular

    angular20.0.0 – 20.3.27

  • angular

    angular21.0.0 – 21.2.19

  • angular

    angular22.0.0 – 22.0.1

  • angular

    angular19.2.25

References & sources

IDCVE-2026-69151