Cross-site scripting in Angular - #VU144103
Published: August 18, 2026
Vulnerability identifier: #VU144103
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the user's browser context.
The vulnerability exists due to improper neutralization of input during web page generation in directive host bindings in @angular/core and @angular/compiler when applying security-sensitive host bindings to concrete host elements with an incorrect or missing security context. A remote attacker can control the value bound to an affected host binding to execute arbitrary JavaScript in the user's browser context.
User interaction is required to load or render the affected application content.
Affected software
Angular
Remediation
Install security update from vendor's website.
Angular - addressed in versions 21.2.20, 22.1.0