CVE-2026-27970

{"id": "CVE-2026-27970", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-26T02:16:24.353", "references": [{"url": "https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/angular/angular/pull/67183", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization."}, {"lang": "es", "value": "Angular es una plataforma de desarrollo para construir aplicaciones web m\u00f3viles y de escritorio usando TypeScript/JavaScript y otros lenguajes. Versiones anteriores a 21.2.0, 21.1.16, 20.3.17 y 19.2.19 tienen una vulnerabilidad de cross-site scripting en la tuber\u00eda de internacionalizaci\u00f3n (i18n) de Angular. En los mensajes ICU (International Components for Unicode), el HTML del contenido traducido no se sanitizaba correctamente y pod\u00eda ejecutar JavaScript arbitrario. La i18n de Angular t\u00edpicamente involucra tres pasos: extraer todos los mensajes de una aplicaci\u00f3n en el lenguaje fuente, enviar los mensajes para ser traducidos y luego fusionar sus traducciones de vuelta al c\u00f3digo fuente final. Las traducciones son frecuentemente manejadas por contratos con compa\u00f1\u00edas asociadas espec\u00edficas, e involucran el env\u00edo de los mensajes fuente a un contratista separado antes de recibir las traducciones finales para su visualizaci\u00f3n al usuario final. Si las traducciones devueltas tienen contenido malicioso, este podr\u00eda ser renderizado en la aplicaci\u00f3n y ejecutar JavaScript arbitrario. Cuando se explota con \u00e9xito, esta vulnerabilidad permite la ejecuci\u00f3n de JavaScript controlado por el atacante en el origen de la aplicaci\u00f3n. Dependiendo de la naturaleza de la aplicaci\u00f3n explotada, esto podr\u00eda llevar a la exfiltraci\u00f3n de credenciales y/o vandalismo de p\u00e1gina. Varias precondiciones se aplican al ataque. El atacante debe comprometer el archivo de traducci\u00f3n (xliff, xtb, etc.). A diferencia de la mayor\u00eda de las vulnerabilidades XSS, este problema no es explotable por usuarios arbitrarios. Un atacante debe primero comprometer el archivo de traducci\u00f3n de una aplicaci\u00f3n antes de que pueda escalar privilegios en el cliente de la aplicaci\u00f3n Angular. La aplicaci\u00f3n v\u00edctima debe usar Angular i18n, usar uno o m\u00e1s mensajes ICU, renderizar un mensaje ICU y no defenderse contra XSS a trav\u00e9s de una pol\u00edtica de seguridad de contenido segura. Las versiones 21.2.0, 21.1.6, 20.3.17 y 19.2.19 parchean el problema. Hasta que se aplique el parche, los desarrolladores deber\u00edan considerar revisar y verificar el contenido traducido recibido de terceros no confiables antes de incorporarlo en una aplicaci\u00f3n Angular, habilitar controles CSP estrictos para bloquear la ejecuci\u00f3n de JavaScript no autorizado en la p\u00e1gina y habilitar Trusted Types para forzar una sanitizaci\u00f3n HTML adecuada."}], "lastModified": "2026-02-27T17:11:53.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F31C6FF7-F094-4AA9-B370-584B3E38677A", "versionEndExcluding": "19.2.19"}, {"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1041B5A8-1BDA-46DD-9D1A-AD34856FC36F", "versionEndExcluding": "20.3.17", "versionStartIncluding": "20.0.0"}, {"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "66E854B9-DE6B-4A38-8CED-098738AF7AF1", "versionEndExcluding": "21.1.6", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next0:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3E704C1A-A984-4809-B67D-50982182527A"}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2175852C-07A5-4A07-B632-3BDE8312D3CC"}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E9E0E76F-101F-44E4-AEC0-948593438B44"}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next3:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2521B32B-A211-4570-98FB-FAEE33551018"}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:rc0:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "07CCF64D-3102-4253-8A52-58CC3EA04DEE"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}