{"action":"Upgrade @angular/compiler to 19.2.20 or later.","affected":[{"fixed":"22.0.0-next.3","introduced":"22.0.0-next.0"},{"fixed":"21.2.4","introduced":"21.0.0-next.0"},{"fixed":"20.3.18","introduced":"20.0.0-next.0.0.0"},{"fixed":"19.2.20","introduced":"19.0.0-next.0"},{"introduced":"17.0.0-next.0","last_affected":"18.2.14"}],"component":"@angular/compiler","cve_ids":["CVE-2026-32635"],"ecosystem":"npm","epss":0.00345,"exploited":false,"fixed_versions":["22.0.0-next.3","21.2.4","20.3.18","19.2.20"],"ghsa_id":"GHSA-g93w-mfhg-p222","id":"tcs_01M5KFR42AF0VXDSZBQE4Q1HC2","modified_at":"2026-05-06T20:48:48.425804Z","published_at":"2026-03-13T20:56:18Z","references":["https://osv.dev/vulnerability/GHSA-g93w-mfhg-p222","https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222","https://nvd.nist.gov/vuln/detail/CVE-2026-32635","https://github.com/angular/angular/pull/67541","https://github.com/angular/angular/pull/67561","https://github.com/angular/angular/commit/224e60ecb1b90115baa702f1c06edc1d64d86187","https://github.com/angular/angular/commit/78dea55351fb305b33a919c43a6b363137eca166","https://github.com/angular/angular/commit/8630319f74c9575a21693d875cc7d5252516146d","https://github.com/angular/angular/commit/ed2d324f9cc12aab6cfa0569ef10b73243a62c65","https://github.com/angular/angular"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-g93w-mfhg-p222#npm/@angular/compiler","url":"https://osv.dev/vulnerability/GHSA-g93w-mfhg-p222"}],"summary":"Angular vulnerable to XSS in i18n attribute bindings"}