CVE-2026-32635
2 advisories.
npm/@angular/core CVE-2026-32635: critical 9
Angular vulnerable to XSS in i18n attribute bindings
Action: Upgrade @angular/core to 19.2.20 or later.
npm i @angular/core@22.0.0-next.3npm i @angular/core@21.2.4npm i @angular/core@20.3.18npm i @angular/core@19.2.20Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0-next.0 | 22.0.0-next.3 | - |
| 21.0.0-next.0 | 21.2.4 | - |
| 20.0.0-next.0.0.0 | 20.3.18 | - |
| 19.0.0-next.0 | 19.2.20 | - |
| 17.0.0-next.0 | - | 18.2.14 |
Fixed versions
| 22.0.0-next.3 | 21.2.4 | 20.3.18 | 19.2.20 |
Sources
- osv: GHSA-g93w-mfhg-p222
- https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222
- https://nvd.nist.gov/vuln/detail/CVE-2026-32635
- https://github.com/angular/angular/pull/67541
- https://github.com/angular/angular/pull/67561
- https://github.com/angular/angular/commit/224e60ecb1b90115baa702f1c06edc1d64d86187
- https://github.com/angular/angular/commit/78dea55351fb305b33a919c43a6b363137eca166
- https://github.com/angular/angular/commit/8630319f74c9575a21693d875cc7d5252516146d
- https://github.com/angular/angular/commit/ed2d324f9cc12aab6cfa0569ef10b73243a62c65
- https://github.com/angular/angular
CVE-2026-32635 · published · modified · JSON
npm/@angular/compiler CVE-2026-32635: critical 9
Angular vulnerable to XSS in i18n attribute bindings
Action: Upgrade @angular/compiler to 19.2.20 or later.
npm i @angular/compiler@22.0.0-next.3npm i @angular/compiler@21.2.4npm i @angular/compiler@20.3.18npm i @angular/compiler@19.2.20Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0-next.0 | 22.0.0-next.3 | - |
| 21.0.0-next.0 | 21.2.4 | - |
| 20.0.0-next.0.0.0 | 20.3.18 | - |
| 19.0.0-next.0 | 19.2.20 | - |
| 17.0.0-next.0 | - | 18.2.14 |
Fixed versions
| 22.0.0-next.3 | 21.2.4 | 20.3.18 | 19.2.20 |
Sources
- osv: GHSA-g93w-mfhg-p222#npm/@angular/compiler
- https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222
- https://nvd.nist.gov/vuln/detail/CVE-2026-32635
- https://github.com/angular/angular/pull/67541
- https://github.com/angular/angular/pull/67561
- https://github.com/angular/angular/commit/224e60ecb1b90115baa702f1c06edc1d64d86187
- https://github.com/angular/angular/commit/78dea55351fb305b33a919c43a6b363137eca166
- https://github.com/angular/angular/commit/8630319f74c9575a21693d875cc7d5252516146d
- https://github.com/angular/angular/commit/ed2d324f9cc12aab6cfa0569ef10b73243a62c65
- https://github.com/angular/angular
CVE-2026-32635 · published · modified · JSON