Angular vulnerable to XSS in i18n attribute bindings

This XSS vulnerability allows an attacker to inject arbitrary JavaScript code into a user's browser when they interact with a vulnerable Angular application. The attack vector involves leveraging Angular's internationalization (i18n-) feature on security-sensitive attributes. By adding i18n-<attribute> to an attribute like href, Angular's built-in sanitization mechanisms are bypassed. If this attribute is then bound to untrusted user-supplied data, an attacker can inject malicious scripts. Successful exploitation could lead to session hijacking, defacement of the application, or redirection to malicious websites. The blast radius extends to all users interacting with the vulnerable application, particularly those who are authenticated.

Applications built with Angular versions 21.0.0 through 21.2.3 are at risk. This includes web applications, single-page applications (SPAs), and any other projects utilizing the @angular/core library. Teams relying on third-party components that depend on these vulnerable versions are also indirectly at risk.

• nodejs / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*node*'} | Select-Object Name, Id, Path

• generic web:

curl -I https://your-angular-app.com/ | grep -i 'x-xss-protection'

• generic web: Inspect the application's source code for instances of i18n- attributes used on security-sensitive HTML elements where the attribute value is bound to user-supplied data.

1. 2026-03-13Disclosure

   disclosure

1. आरक्षित2026-03-12
2. प्रकाशित2026-03-13
3. संशोधित2026-03-17
4. EPSS अद्यतन2026-03-23

The primary mitigation is to upgrade to @angular/core version 21.2.4 or later, which contains the fix. If upgrading immediately is not feasible, developers should carefully review their code for instances where security-sensitive attributes are used with Angular's internationalization feature. Avoid using i18n-<attribute> on attributes like href, src, or onclick when the value is derived from untrusted user input. Implement robust input validation and sanitization to prevent the injection of malicious scripts. Consider using a Web Application Firewall (WAF) with XSS protection rules to filter out potentially malicious requests. After upgrading, confirm the fix by testing the application with various inputs, including those designed to trigger XSS vulnerabilities.