The vulnerability (CVE-2026-50557) arises from improper handling of namespaced elements and attributes in Angular's template compiler and runtime sanitizers. Namespaced script elements like <svg:script> were not recognized as script tags, allowing them to bypass Angular's script-stripping logic. Additionally, attribute sanitization did not consistently apply to attributes within namespaced elements (e.g., SVG, MathML), creating gaps for malicious attribute injection. Exploitation requires an Angular application that compiles user-controlled templates at runtime and does not perform separate input sanitization. This leads to client-side XSS by executing arbitrary JavaScript in the user's browser context.

Successful exploitation allows attackers to inject script elements or malicious attributes that bypass Angular's sanitization, resulting in client-side Cross-Site Scripting (XSS). This can lead to session hijacking, exposure of sensitive information, or unauthorized actions performed on behalf of the user. The vulnerability specifically affects applications that compile user-supplied templates at runtime and rely on Angular's sanitization for namespaced elements and attributes.

Official fixes are available in Angular versions 19.2.23, 20.3.22, 21.2.15, and 22.0.0-rc.2. Users should upgrade to one of these versions or later to remediate the vulnerability. Applications should avoid compiling user-controlled templates at runtime or implement additional input sanitization before template compilation to reduce risk. Patch status is confirmed by the vendor advisory. No additional mitigations are indicated beyond applying the official fixes or avoiding the vulnerable usage pattern.