CVE-2026-22610

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-22610
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56 Patch
https://github.com/angular/angular/pull/66318 Issue Tracking
https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6 Vendor Advisory Mitigation
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next0:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next1:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next2:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next3:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next4:*:*:*:node.js:*:*
History

23 Feb 2026, 18:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
References () https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56 - () https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56 - Patch
References () https://github.com/angular/angular/pull/66318 - () https://github.com/angular/angular/pull/66318 - Issue Tracking
References () https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6 - () https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6 - Vendor Advisory, Mitigation
First Time Angular
Angular angular
CPE cpe:2.3:a:angular:angular:21.1.0:next1:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next4:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next3:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next2:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*
cpe:2.3:a:angular:angular:21.1.0:next0:*:*:*:node.js:*:*

10 Jan 2026, 04:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-10 04:16

Updated : 2026-02-23 18:23

NVD link : CVE-2026-22610

Mitre link : CVE-2026-22610

CVE.ORG link : CVE-2026-22610

JSON object : View

Products Affected

angular

  • angular
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')