The XSS flaw, a classic example of CWE-79 (Cross‑Site Scripting), arises when Angular i18n processes ICU messages from external translation files. Because HTML within the translated content is not sanitized, a malicious translator can inject JavaScript that runs in the context of the application. Once executed, the script can steal credentials, modify the page or perform other client‑side attacks, effectively giving an attacker remote code execution within the application origin. The likely attack vector is the injection of malicious HTML into an external translation file that Angular will later parse and render.

Angular developers who still use versions older than 21.2.0, 21.1.16, 20.3.17 or 19.2.19 – including any pre‑release builds such as 21.2.0‑next0, 21.2.0‑next1, 21.2.0‑next2, 21.2.0‑next3 or 21.2.0‑rc0 – are exposed. The vulnerability is triggered only when the application uses Angular i18n with ICU messages that are parsed from an external translation file (e.g., XLIFF or XTB). Applications that do not use i18n or do not render ICU messages are not affected. Based on the description, it is inferred that the flaw is only exploitable when translation files are imported from third‑party sources.

The CVSS base score of 7.6 indicates a moderate to high severity. The EPSS score of less than 1 % suggests that, while the flaw is known, the probability of exploitation in the near term is low, partly because an attacker must gain access to a translation file or supply a malicious translation. The vulnerability is not listed in the CISA KEV catalogue, and there is no indication of public exploits at this time. Nonetheless, the potential impact – arbitrary client‑side code execution – warrants immediate remediation. The likely attack vector involves an attacker compromising or forging a translation file that is subsequently merged into the application, allowing the injection of untrusted HTML that is rendered with user privileges.