Angular allows developers to internationalize attribute values with the i18n- attribute syntax. For security‑sensitive attributes such as href, the framework normally sanitizes bound values to prevent script execution. However, when an attribute is internationalized, Angular’s sanitization is bypassed. If the bound value originates from untrusted user‑generated data, an attacker can inject malicious JavaScript that executes in the context of the affected web page, leading to credential theft, defacement, or further exploitation. The flaw is a classic CWE‑79 cross‑site scripting weakness. This attack can occur entirely on the client side and does not require any server‑side code changes.

The vulnerability exists in the Angular runtime and compiler packages (@angular:compiler, @angular:core). It affects all releases before 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20. Users running any of these older versions should assess whether the application renders sensitive attributes that are bound to user data and have i18n enabled.

The CVSS base score for this issue is 8.6, indicating high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious user or content provider to supply the vulnerable input to the application, typically via a crafted URL or form input that binds to a sensitive attribute such as href. Once the client browser renders the page, the injected script runs with the user’s privileges.