{"action":"Upgrade @angular/compiler to 19.2.18 or later.","affected":[{"fixed":"21.1.0-rc.0","introduced":"21.1.0-next.0"},{"fixed":"21.0.7","introduced":"21.0.0-next.0"},{"fixed":"20.3.16","introduced":"20.0.0-next.0"},{"fixed":"19.2.18","introduced":"19.0.0-next.0"},{"introduced":"0","last_affected":"18.2.14"}],"component":"@angular/compiler","cve_ids":["CVE-2026-22610"],"ecosystem":"npm","epss":0.00439,"exploited":false,"fixed_versions":["21.1.0-rc.0","21.0.7","20.3.16","19.2.18"],"ghsa_id":"GHSA-jrmj-c5cx-3cw6","id":"tcs_01M5KFYV1V36PA3ZS4MHY2RERV","modified_at":"2026-09-10T03:50:33.469090469Z","published_at":"2026-01-09T18:52:14Z","references":["https://osv.dev/vulnerability/GHSA-jrmj-c5cx-3cw6","https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6","https://nvd.nist.gov/vuln/detail/CVE-2026-22610","https://github.com/angular/angular/pull/66318","https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://github.com/angular/angular"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-jrmj-c5cx-3cw6","url":"https://osv.dev/vulnerability/GHSA-jrmj-c5cx-3cw6"},{"source":"nvd","source_id":"CVE-2026-22610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22610"}],"summary":"Angular has XSS Vulnerability via Unsanitized SVG Script Attributes"}