Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00044.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
@angular compiler affected
Version Status Constraints
>= 22.0.0-next.0, < 22.0.0-next.3 affected
—
>= 21.0.0-next.0, < 21.2.4 affected
—
>= 20.0.0-next.0, < 20.3.18 affected
—
>= 17.0.0.next.0, < 19.2.20 affected
—
@angular core affected
Version Status Constraints
>= 22.0.0-next.0, < 22.0.0-next.3 affected
—
>= 21.0.0-next.0, < 21.2.4 affected
—
>= 20.0.0-next.0, < 20.3.18 affected
—
>= 17.0.0.next.0, < 19.2.20 affected
—

No data.

No data.

Vendor Product Confidence Versions
Angular Angular 100%
Version Status Scheme Platform
[22.0.0-next.0,22.0.0-next.3)
 affected semver —
[21.0.0-next.0,21.2.4)
 affected semver —
[20.0.0-next.0,20.3.18)
 affected semver —
[17.0.0.next.0,19.2.20)
 affected generic —
Angular Compiler 100%
Version Status Scheme Platform
[22.0.0-next.0,22.0.0-next.3)
 affected semver —
[21.0.0-next.0,21.2.4)
 affected semver —
[20.0.0-next.0,20.3.18)
 affected semver —
[17.0.0.next.0,19.2.20)
 affected generic —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Project Subscriptions

Vendors Products
Angular Subscribe
Angular Subscribe
Compiler Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/angular/angular/pull/67541 cve-icon cve-icon cve-icon
https://github.com/angular/angular/pull/67561 cve-icon cve-icon cve-icon
https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-32635 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-32635 cve-icon
History

Tue, 17 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

threat_severity

Moderate

Mon, 16 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Angular
Angular angular
Angular compiler
Vendors & Products Angular
Angular angular
Angular compiler

Fri, 13 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Description Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
Title Angular has XSS in i18n attribute bindings
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-17T03:55:33.785Z

Reserved: 2026-03-12T15:29:36.559Z

Link: CVE-2026-32635

cve-icon Vulnrichment

Updated: 2026-03-16T15:31:34.969Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-16T14:19:40.753

Modified: 2026-03-16T14:53:07.390

Link: CVE-2026-32635

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-13T20:58:12Z

Links: CVE-2026-32635 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-16T09:22:55Z

Weaknesses