Other information and services of the government: www.belgium.be Centre for Cybersecurity Belgium
search

Warning: XSS vulnerability in Angular. Patch Immediately!

Image
Decorative image
Published : 17/03/2026
  • Last update: 17/03/2026
  • Affected software:
    → Angular
  • Type: Cross Site Scripting (CWE-79)
  • CVE/CVSS
    → CVE-2026-32635: 8.6 HIGH (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

Sources

Vendor Advisory - https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222

Risks

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables session hijacking (stealing session cookies and authentication tokens), data exfiltration, and unauthorised actions on behalf of the user.

Description

Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalise attributes.

Enabling internationalisation for the sensitive attribute by adding i18n- name bypasses Angular's built-in sanitisation mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.

This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

Recommended Actions

Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable instances with the highest priority after thorough testing.

More information on the vendor’s website: https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222

Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via >https://ccb.belgium.be/en/cert/report-incident>.

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

References

Vendor Advisory - https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222