The @angular/compiler package contains a sanitization bypass vulnerability (CVE-2026-54265) related to two-way property bindings on native DOM properties that require sanitization (e.g., innerHTML, src, href). The Angular template compiler does not apply the appropriate sanitizer function for two-way bindings, allowing unsanitized values to be bound and potentially enabling client-side Cross-Site Scripting (XSS). This issue affects Angular versions <=19.2.25 and has been fixed in versions 20.3.25, 21.2.17, and 22.0.1. Successful exploitation requires that the application uses two-way binding syntax on sensitive properties with user-controlled input and no additional sanitization.

Applications using vulnerable Angular versions that bind user-controllable input to sensitive DOM properties via two-way binding are at risk of client-side XSS attacks. This can lead to arbitrary JavaScript execution in the context of the user's browser, potentially resulting in session hijacking, exposure of sensitive information, or unauthorized actions performed on behalf of the user.

Upgrade to one of the patched versions: 20.3.25, 21.2.17, or 22.0.1 of @angular/compiler. Until patched, avoid using two-way binding syntax on sensitive native DOM properties such as innerHTML, src, href, data, or sandbox, especially with user-controlled input. Alternatively, apply manual sanitization (e.g., via Angular's DomSanitizer) before binding values to these properties. Patch status is confirmed by the vendor advisory indicating fixed versions.