A newly discovered Angular vulnerability allows attackers to execute malicious payloads, posing serious risks to affected applications.
Angular’s Template Compiler has a serious Cross-Site Scripting (XSS) flaw that affects various versions of the @angular/compiler and @angular/core packages.
This vulnerability, known as CVE-2026-22610, enables attackers to get around Angular’s built-in security measures and run arbitrary JavaScript code in vulnerable browsers.
The defect is in Angular’s internal sanitization schema, which does not correctly identify SVG <script> elements’ href and xlink:href properties as resource URLs that need stringent validation.
Because of this carelessness, attackers can leverage template bindings to inject malicious payloads and run unauthorized code during user sessions.
The compiler handles these SVG script attributes as regular strings instead of hazardous resource links when developers utilize Angular’s property binding syntax (such as [attr.href]=”userInput”).
Malicious data, such as text/JavaScript URIs or links to external malicious scripts, can evade security tests due to this misclassification. If this vulnerability is successfully exploited, there could be dire repercussions.
To take over user accounts, attackers may steal session cookies, localStorage information, or authentication tokens.
Additionally, they could take unauthorized acts on behalf of verified users or steal confidential data that is displayed in applications.
The vulnerability has a 7.6 (High severity) CVSS v4 base score. To exploit it, minimal attack complexity and comparatively low privilege levels are needed.
Specific requirements must be met for exploitation: the bound data must come from untrusted sources, and the target application must use SVG <script> elements in templates with dynamic property or attribute bindings for href or xlink:href attributes.
The GitHub advisory states that developers should update Angular to patched versions right away.
Adopt stringent server-side input validation for any dynamic URL values before they reach templates, and refrain from using dynamic bindings with SVG script elements until changes are made.
