Angular vulnerabilities in earlier releases allowed an attacker to inject malicious script content into DOM attributes by exploiting sanitized directive host bindings. The flaw arose because the compiler and runtime chose a sanitizer based on the component or directive selector rather than the concrete host element, enabling the use of URLs, hrefs, or data attributes that bypass Angular’s built‑in sanitization. This defect could lead to execution of arbitrary JavaScript in the user’s browser, compromising confidentiality and integrity of the application. The weakness is an example of CWE‑79.

The affected products are the angular:angular framework, specifically the @angular/core and @angular/compiler libraries in versions prior to 20.3.28, 21.2.20, and 22.1.0. Angular versions earlier than these releases are susceptible; the issue does not affect later releases.

The vulnerability has a base CVSS score of 5.3, indicating a moderate risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by creating or manipulating host directives, inherited HostBinding declarations, or using custom host elements—also via SVG/MathML or tag‑neutral selectors. By controlling attributes such as href or src, the attacker can inject JavaScript that runs in the client’s context. The exploit path requires legitimate Access to the application’s code or the ability to inject directives or components, which many web applications expose through user input.