Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).
When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.
The following example illustrates a vulnerable pattern:
<img src="foo.jpg" onerror="void 0" i18n-onerror />Impact
When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to:
- Session Hijacking: Accessing session cookies, tokens, or sensitive user data.
- Unauthorized Actions: Performing actions on behalf of the authenticated user.
Patched Versions
- 22.0.1
- 21.2.19
- 20.3.27
Workarounds
Ensure that static event-handler attributes (e.g., onerror, onclick) are never marked for internationalization (i18n-on*) in application templates, and ensure translation files are sourced from trusted origins.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | @angular/compiler | >= 22.0.0-next.0, < 22.0.1, >= 21.0.0-next.0, < 21.2.19, >= 20.0.0-next.0, < 20.3.27, <= 19.2.25 | 22.0.1, 21.2.19, 20.3.27 |
| Paquete de npm | @angular/core | >= 22.0.0-next.0, < 22.0.1, >= 21.0.0-next.0, < 21.2.19, >= 20.0.0-next.0, < 20.3.27, <= 19.2.25 | 22.0.1, 21.2.19, 20.3.27 |
Referencias
- https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99
- https://github.com/angular/angular/pull/68821
- https://github.com/angular/angular/pull/69306
- https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e
- https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865
- https://github.com/angular/angular
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-79- Plataforma
- npm
- Paquete
@angular/compiler, @angular/core- Publicada
- 03.08.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-jj27-h5hq-8x99 - CC BY 4.0
Historial de vulnerabilidades: @angular/compiler
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 7
- Primera → última
- 12.2025 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
- Media 3
Divulgaciones por año
- 2025: 1
- 2026: 6
-
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.