{"action":"Upgrade @angular/core to 20.3.27 or later.","affected":[{"fixed":"22.0.1","introduced":"22.0.0-next.0"},{"fixed":"21.2.19","introduced":"21.0.0-next.0"},{"fixed":"20.3.27","introduced":"20.0.0-next.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/core","cve_ids":["CVE-2026-69151"],"ecosystem":"npm","epss":0.00333,"exploited":false,"fixed_versions":["22.0.1","21.2.19","20.3.27"],"ghsa_id":"GHSA-jj27-h5hq-8x99","id":"tcs_01M5KFY6ECV2R6MDFMEYX58HX2","modified_at":"2026-08-03T16:41:45.314415Z","published_at":"2026-08-03T16:23:40Z","references":["https://osv.dev/vulnerability/GHSA-jj27-h5hq-8x99","https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99","https://github.com/angular/angular/pull/68821","https://github.com/angular/angular/pull/69306","https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e","https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865","https://github.com/angular/angular"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-jj27-h5hq-8x99#npm/@angular/core","url":"https://osv.dev/vulnerability/GHSA-jj27-h5hq-8x99"}],"summary":"Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes"}