The vulnerability lies within Angular’s compiler i18n pipeline, which prior to the specified releases incorrectly permits i18n‑onerror and other event‑handler attributes in translation files to be interpreted as executable JavaScript. This flaw enables a translation file from a lower‑trust source to inject malicious code that runs when the application renders translated content. The result is classic Cross‑Site Scripting that can compromise user data, allow session hijacking, and facilitate further browser‑based attacks.

Angular compiler (@angular:compiler), Angular core (@angular:core), and Angular framework (angular:angular) packages that are older than versions 20.3.27, 21.2.19, and 22.0.1 respectively. The issue is fixed in those releases and all later versions, so upgrading removes the attack surface.

The CVSS score of 7.6 denotes a high severity vulnerability. EPSS for this flaw is not available, so the exploitation probability cannot be quantified, but because the attack relies on malicious translation files, the risk is driven by the integrity of the translation supply chain. The vulnerability is not listed in the CISA KEV catalog, yet the potential for XSS persists until the affected packages are updated. Prompt patching is recommended to mitigate the risk.