Answer in brief
CVE-2026-69151 records a High severity xss vulnerability in Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes. The source record does not mark it as known exploited. 8 affected packages are mapped in the feed.
Answer in brief
CVE-2026-69151 records a High severity xss vulnerability in Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes. The source record does not mark it as known exploited. 8 affected packages are mapped in the feed.
Update @angular/compiler to 22.0.1; @angular/compiler to 21.2.19; @angular/compiler to 20.3.27; @angular/core to 22.0.1; @angular/core to 21.2.19; @angular/core to 20.3.27 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanXSS describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-69151 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @angular/compilernpm | >=22.0.0-next.0,<22.0.1 | 22.0.1 |
| @angular/compilernpm | >=21.0.0-next.0,<21.2.19 | 21.2.19 |
| @angular/compilernpm | >=20.0.0-next.0,<20.3.27 | 20.3.27 |
| @angular/compilernpm | <=19.2.25 | Not reported |
| @angular/corenpm | >=22.0.0-next.0,<22.0.1 | 22.0.1 |
| @angular/corenpm | >=21.0.0-next.0,<21.2.19 | 21.2.19 |
| @angular/corenpm | >=20.0.0-next.0,<20.3.27 | 20.3.27 |
| @angular/corenpm | <=19.2.25 | Not reported |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-69151 records a High severity xss vulnerability in Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes. The source record does not mark it as known exploited. 8 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @angular/compiler, @angular/compiler, @angular/compiler.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate @angular/compiler to 22.0.1; @angular/compiler to 21.2.19; @angular/compiler to 20.3.27; @angular/core to 22.0.1; @angular/core to 21.2.19; @angular/core to 20.3.27 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanXSS describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-69151 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @angular/compilernpm | >=22.0.0-next.0,<22.0.1 | 22.0.1 |
| @angular/compilernpm | >=21.0.0-next.0,<21.2.19 | 21.2.19 |
| @angular/compilernpm | >=20.0.0-next.0,<20.3.27 | 20.3.27 |
| @angular/compilernpm | <=19.2.25 | Not reported |
| @angular/corenpm | >=22.0.0-next.0,<22.0.1 | 22.0.1 |
| @angular/corenpm | >=21.0.0-next.0,<21.2.19 | 21.2.19 |
| @angular/corenpm | >=20.0.0-next.0,<20.3.27 | 20.3.27 |
| @angular/corenpm | <=19.2.25 | Not reported |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-69151 records a High severity xss vulnerability in Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes. The source record does not mark it as known exploited. 8 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @angular/compiler, @angular/compiler, @angular/compiler.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardA Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAttribute()` / `validateProperty()`), the i18n metadata collection path allowed these same attribute names to be marked for translation using `i18n-on*` attributes (e.g., `i18n-onerror`). When exploited, a lower-trust translation file could replace a benign static handler such as `onerror="void 0"` with arbitrary executable JavaScript in the localized build. The following example illustrates a vulnerable pattern: ```html <img src="foo.jpg" onerror="void 0" i18n-onerror /> ``` ### Impact When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to: - **Session Hijacking**: Accessing session cookies, tokens, or sensitive user data. - **Unauthorized Actions**: Performing actions on behalf of the authenticated user. ### Patched Versions - 22.0.1 - 21.2.19 - 20.3.27 ### Workarounds Ensure that static event-handler attributes (e.g., `onerror`, `onclick`) are never marked for internationalization (`i18n-on*`) in application templates, and ensure translation files are sourced from trusted origins.
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAttribute()` / `validateProperty()`), the i18n metadata collection path allowed these same attribute names to be marked for translation using `i18n-on*` attributes (e.g., `i18n-onerror`). When exploited, a lower-trust translation file could replace a benign static handler such as `onerror="void 0"` with arbitrary executable JavaScript in the localized build. The following example illustrates a vulnerable pattern: ```html <img src="foo.jpg" onerror="void 0" i18n-onerror /> ``` ### Impact When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to: - **Session Hijacking**: Accessing session cookies, tokens, or sensitive user data. - **Unauthorized Actions**: Performing actions on behalf of the authenticated user. ### Patched Versions - 22.0.1 - 21.2.19 - 20.3.27 ### Workarounds Ensure that static event-handler attributes (e.g., `onerror`, `onclick`) are never marked for internationalization (`i18n-on*`) in application templates, and ensure translation files are sourced from trusted origins.