A Cross-Site Scripting (XSS) vulnerability exists in Angular's runtime and compiler when using internationalized attribute bindings (i18n-<attribute>) on certain security-sensitive attributes. This bypasses Angular's sanitization, allowing injection of malicious scripts if untrusted user input is bound to these attributes. The vulnerability affects multiple attributes including href, src, action, and others. Exploitation can lead to arbitrary code execution in the application's domain, enabling session hijacking, data exfiltration, and unauthorized actions. Fixed versions are available starting from 19.2.20, 20.3.18, 21.2.4, and 22.0.0-next.3.