Compiler: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes (CVE-2026-69151)
A Cross-Site Scripting (XSS) vulnerability exists in the Angular compiler's internationalization (i18n) pipeline. The issue arises because event-handler attributes like 'onerror' can be marked for translation using 'i18n-on*' attributes, bypassing standard Angular attribute validation. This allows a lower-trust translation file to inject arbitrary JavaScript in localized builds. Exploitation requires control or influence over translation files. Patched versions include 20.3.27, 21.2.19, and 22.0.1.
AI Analysis
Technical Summary
The Angular compiler's i18n pipeline improperly allows event-handler attributes (e.g., 'onerror') to be marked for translation via 'i18n-on*' attributes, circumventing Angular's standard attribute validation that disallows binding to such event handlers. This flaw enables an attacker who can supply or modify translation files to inject arbitrary JavaScript code into localized builds, leading to Cross-Site Scripting (XSS). The vulnerability affects Angular compiler versions up to and including 19.2.25 and has been fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Potential Impact
Successful exploitation allows arbitrary JavaScript execution within the context of the vulnerable Angular application's domain. This can lead to session hijacking by accessing session cookies or tokens and performing unauthorized actions on behalf of authenticated users. The vulnerability requires attacker control or influence over translation files used during localization.
Mitigation Recommendations
A fix is available in Angular compiler versions 20.3.27, 21.2.19, and 22.0.1. Users should upgrade to one of these patched versions. Additionally, ensure that static event-handler attributes (e.g., 'onerror', 'onclick') are never marked for internationalization using 'i18n-on*' in application templates. Translation files should be sourced only from trusted origins to prevent injection of malicious code.
Compiler: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes (CVE-2026-69151)
Description
A Cross-Site Scripting (XSS) vulnerability exists in the Angular compiler's internationalization (i18n) pipeline. The issue arises because event-handler attributes like 'onerror' can be marked for translation using 'i18n-on*' attributes, bypassing standard Angular attribute validation. This allows a lower-trust translation file to inject arbitrary JavaScript in localized builds. Exploitation requires control or influence over translation files. Patched versions include 20.3.27, 21.2.19, and 22.0.1.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Angular compiler's i18n pipeline improperly allows event-handler attributes (e.g., 'onerror') to be marked for translation via 'i18n-on*' attributes, circumventing Angular's standard attribute validation that disallows binding to such event handlers. This flaw enables an attacker who can supply or modify translation files to inject arbitrary JavaScript code into localized builds, leading to Cross-Site Scripting (XSS). The vulnerability affects Angular compiler versions up to and including 19.2.25 and has been fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Potential Impact
Successful exploitation allows arbitrary JavaScript execution within the context of the vulnerable Angular application's domain. This can lead to session hijacking by accessing session cookies or tokens and performing unauthorized actions on behalf of authenticated users. The vulnerability requires attacker control or influence over translation files used during localization.
Mitigation Recommendations
A fix is available in Angular compiler versions 20.3.27, 21.2.19, and 22.0.1. Users should upgrade to one of these patched versions. Additionally, ensure that static event-handler attributes (e.g., 'onerror', 'onclick') are never marked for internationalization using 'i18n-on*' in application templates. Translation files should be sourced only from trusted origins to prevent injection of malicious code.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jj27-h5hq-8x99
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-69151"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a710665bf32cb7a34394b20
Added to database: 08/03/2026, 21:21:41 UTC
Last enriched: 08/03/2026, 21:31:46 UTC
Last updated: 08/04/2026, 01:51:57 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.