CVE-2026-27970

npm/@angular/core CVE-2026-27970: medium 6.1

Angular i18n vulnerable to Cross-Site Scripting

Action: Upgrade @angular/core to 19.2.19 or later.

npm i @angular/core@21.2.0

npm i @angular/core@21.1.6

npm i @angular/core@20.3.17

npm i @angular/core@19.2.19

Affected

Fixed versions

Sources

• osv: GHSA-prjf-86w9-mfqv
• https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv
• https://nvd.nist.gov/vuln/detail/CVE-2026-27970
• https://github.com/angular/angular/pull/67183
• https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d
• https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232
• https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93
• https://angular.dev/best-practices/security#enforcing-trusted-types
• https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
• https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS
• https://github.com/angular/angular

CVE-2026-27970 · published 2026-02-27T18:33:16Z · modified 2026-09-10T03:50:59.526027948Z · JSON