Threats affecting pkg:npm/@angular/core

CVE-2026-111751 is a high-severity vulnerability in Angular versions 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0. It involves uncontrolled resource consumption during Node.js server-side rendering when RouterLink directives retain computed UrlTree instances containing attacker-controlled query parameters. This can lead to excessive memory use and termination of the SSR worker. The issue is fixed in Angular versions 21.2.25 and 22.2.1.

A sanitization bypass vulnerability in Angular's @angular/core package allowed untrusted values bound via directive host bindings to security-sensitive DOM attributes to bypass Angular's built-in sanitizer. This occurred because the Angular compiler determined the security context based on the directive or component selector rather than the actual host element, leading to incorrect or missing sanitization. This flaw could enable Cross-Site Scripting (XSS) attacks if an attacker controls the bound value. The issue is fixed in Angular versions 22.1.0, 21.2.20, and 20.3.28.

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAttribute()` / `validateProperty()`), the i18n metadata collection path allowed these same attribute names to be marked for translation using `i18n-on*` attributes (e.g., `i18n-onerror`). When exploited, a lower-trust translation file could replace a benign static handler such as `onerror="void 0"` with arbitrary executable JavaScript in the localized build. The following example illustrates a vulnerable pattern: ```html <img src="foo.jpg" onerror="void 0" i18n-onerror /> ``` ### Impact When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to: - **Session Hijacking**: Accessing session cookies, tokens, or sensitive user data. - **Unauthorized Actions**: Performing actions on behalf of the authenticated user. ### Patched Versions - 22.0.1 - 21.2.19 - 20.3.27 ### Workarounds Ensure that static event-handler attributes (e.g., `onerror`, `onclick`) are never marked for internationalization (`i18n-on*`) in application templates, and ensure translation files are sourced from trusted origins.

An issue in the `@angular/compiler` and `@angular/core` packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., `<svg:script>` or `<:svg:script>`) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). ### Impact Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass. Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user. ### Attack Preconditions To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist: 1. **User-Controlled Template Input:** The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime. 2. **Namespace Parsing Support:** The input structure must employ custom namespace prefixes (such as `<svg:script>`) to evade standard tag-name blocklists/checks. 3. **Absence of Additional Context Sanitization:** The application does not perform separate input sanitization before feeding values to the Angular compiler. ### Patches * 22.0.0-rc.2 * 21.2.15 * 20.3.22 * 19.2.23

An issue in the `@angular/core` package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (`createComponent`) failed to reject mounting components directly onto a `<script>` or namespaced script element (such as `<svg:script>`). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to `createComponent` to initialize or mount an Angular component directly onto a `<script>` tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). ### Impact Any Angular application that registers dynamic components based on user-supplied parameters (like selectors or host elements) is vulnerable to this security bypass. Once exploited, this allows a malicious actor to mount a dynamic component on a script tag, bypassing core dynamic component creation safeguards to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user. ### Attack Preconditions To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist: 1. **User-Controlled Host Selection:** The application must accept user-controlled inputs that are passed as a selector/host element to `createComponent`. 2. **Absence of Additional Context Sanitization:** The application does not perform separate input sanitization before feeding values to the dynamic creation APIs. ### Patches * 22.0.0-rc.2 * 21.2.15 * 20.3.22 * 19.2.23

To optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports **Hydration** via `provideClientHydration()`. During SSR, Angular serializes the application's runtime state (such as cached `HttpClient` responses) and outputs it into the HTML stream as a `<script>` tag with a predictable identifier: ```html <script type="application/json" id="ng-state"> {"some-api-url": {"body": ...}} </script> ```` During client bootstrap, Angular recovers this state by looking up the element via `document.getElementById('ng-state')` and parsing its text content. Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (`ng-state`), it is susceptible to **DOM Clobbering**. If the application binds untrusted user input or CMS content to element properties such as `id` (e.g., `<div [id]="userInput">` or `<a id="ng-state">`) *before* the genuine `<script>` tag is parsed by the browser, the attacker-controlled element takes precedence in the DOM lookup. During hydration, when Angular calls `document.getElementById('ng-state')`, the browser returns the attacker's clobbered element. Angular then attempts to parse the text content or attributes of this clobbered element as JSON. ### Impact By clobbering the state element, the attacker can inject a custom JSON payload into Angular's `TransferState` cache. The most critical exploitation vector is poisoning the **HTTP Transfer Cache**. 1. The attacker injects a clobbered `ng-state` element containing custom JSON. 2. The JSON maps a key (representing a target API endpoint URL) to a malicious payload of the attacker's choice. 3. During client-side initialization, Angular's `HttpClient` checks `TransferState` before making requests. Finding the poisoned key, `HttpClient` returns the forged response instantly instead of requesting the genuine backend API. Depending on how the application processes and renders the affected API response, this can lead to: * **DOM-based Cross-Site Scripting (XSS)** if poisoned fields are rendered using unsafe bindings. * **Privilege Escalation** by spoofing user info or session details retrieved from poisoned API payloads. * **UI Hijacking** and redirection by spoofing configuration endpoints. ### Patched Versions * 22.0.1 * 21.2.17 * 20.3.25 ### Workarounds If you cannot immediately update to a patched Angular version, apply the following workarounds: #### A. Avoid Dynamic/User-Controlled IDs Avoid binding raw user-supplied values or dynamic CMS IDs directly to element attributes. If dynamic IDs are required, sanitize them or prepend a static safe prefix: ```html <!-- Vulnerable Pattern --> <div [id]="userControlledInput">...</div> <!-- Mitigated Pattern --> <div [id]="'safe-prefix-' + userControlledInput">...</div> ``` #### B. Configure a Custom Application ID Declaring a unique, non-predictable `APP_ID` changes the ID suffix of the state element, making it harder for attackers to predict and target: ```ts // app.config.ts import { APP_ID } from '@angular/core'; import { provideClientHydration } from '@angular/platform-browser'; export const appConfig = { providers: [ { provide: APP_ID, useValue: 'unique-obfuscated-app-id' }, provideClientHydration() ] }; ``` This changes the state element lookup ID from `ng-state` to `unique-obfuscated-app-id-state`.

A Cross-Site Scripting (XSS) vulnerability exists in Angular's runtime and compiler when using internationalized attribute bindings (i18n-<attribute>) on certain security-sensitive attributes. This bypasses Angular's sanitization, allowing injection of malicious scripts if untrusted user input is bound to these attributes. The vulnerability affects multiple attributes including href, src, action, and others. Exploitation can lead to arbitrary code execution in the application's domain, enabling session hijacking, data exfiltration, and unauthorized actions. Fixed versions are available starting from 19.2.20, 20.3.18, 21.2.4, and 22.0.0-next.3.