CVE Reports

Posted on Aug 3 • Originally published at cvereports.com

CVE-2026-69151: CVE-2026-69151: Stored Cross-Site Scripting (XSS) in Angular Compiler i18n Pipeline via Event-Handler Attributes

#security #cve #cybersecurity

CVE-2026-69151: Stored Cross-Site Scripting (XSS) in Angular Compiler i18n Pipeline via Event-Handler Attributes

Vulnerability ID: CVE-2026-69151
CVSS Score: 7.6
Published: 2026-08-03

A high-severity security vulnerability has been identified within the Angular compiler's internationalization (i18n) metadata collection and translation pipeline. Angular implements strict defenses against client-side execution injection by validating standard attribute and property bindings. However, when parsing elements containing both i18n translation attributes and inline event-handler elements (such as i18n-onerror), the compiler failed to assert the safety of the target attribute. Consequently, compromised or untrusted localization translation source files can supply arbitrary JavaScript payloads that replace static event-handler bindings. This arbitrary code is compiled directly into the localized build bundle and executed dynamically by the web browser, bypassing runtime sanitization, security checks, and standard binding constraints.

TL;DR

An input validation flaw in the Angular compiler's i18n translation metadata pipeline enables unauthenticated stored Cross-Site Scripting (XSS) when utilizing untrusted translation assets. Attackers who compromise translation databases or localization files can inject arbitrary JavaScript executable payloads into translated attributes like i18n-onerror. Standard Angular runtime property-binding security validations fail to catch this injection because the malicious payloads are rendered as static attributes in the compiled HTML document, enabling full client-side session compromise.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Attack Vector: Network / Content Supply Chain Injection
Attack Complexity: Low (No special conditions required)
Authentication Requirements: None (Requires access to influence external translation resources)
CVSS v4.0 Base Score: 7.6 (High)
Exploit Status: Proof-of-Concept (No known active exploitation in the wild)
CISA KEV Status: Not Listed

Affected Systems

Angular compiler (@angular/compiler)
Angular core runtime (@angular/core)
@angular/compiler: < 20.3.27 (Fixed in: 20.3.27)
@angular/compiler: >= 21.0.0-next.0, < 21.2.19 (Fixed in: 21.2.19)
@angular/compiler: >= 22.0.0-next.0, < 22.0.1 (Fixed in: 22.0.1)
@angular/core: < 20.3.27 (Fixed in: 20.3.27)
@angular/core: >= 21.0.0-next.0, < 21.2.19 (Fixed in: 21.2.19)
@angular/core: >= 22.0.0-next.0, < 22.0.1 (Fixed in: 22.0.1)

Code Analysis

Commit: 6c41f5c

compiler: disallow translating event attributes starting with on to prevent stored XSS

@@ -208,7 +208,7 @@ export class I18nMetaVisitor implements html.Visitor {
             isTrustedType = isTrustedTypesSink(node.name, name);
           }

-          if (isTrustedType) {
+          if (isTrustedType || name.toLowerCase().startsWith('on')) {
             this._reportError(
               attr,
               `Translating attribute '${name}' is disallowed for security reasons.`,

Commit: 417a407

compiler: refine event-attribute check to allow benign attributes such as literal 'on'

@@ -208,7 +208,7 @@ export class I18nMetaVisitor implements html.Visitor {
             isTrustedType = isTrustedTypesSink(node.name, name);
           }

-          if (isTrustedType || name.toLowerCase().startsWith('on')) {
+          if (isTrustedType || isPossibleEventHandler(name)) {
             this._reportError(
               attr,
               `Translating attribute '${name}' is disallowed for security reasons.`,
@@ -350,3 +350,14 @@ export function i18nMetaToJSDoc(meta: I18nMeta): o.JSDocComment {
   }
   return o.jsDocComment(tags);
 }
+
+function isPossibleEventHandler(propertyName: string): boolean {
+  const name = propertyName.toLowerCase();
+  return name.length > 2 && name !== 'only' && name.startsWith('on');
+}

Mitigation Strategies

Upgrade Angular compiler and core libraries to patched versions (20.3.27, 21.2.19, or 22.0.1)
Audit existing HTML templates to ensure event handlers are never marked for translation via i18n-on* attributes
Treat translation metadata files (XLF, XLIFF, JSON) as high-risk assets and enforce strict code review pipelines
Enforce a rigorous Content Security Policy (CSP) that bans the 'unsafe-inline' script directive

Remediation Steps:

Open the project package.json file and identify the versions of @angular/compiler and @angular/core.
Execute the update command matching your current release branch (e.g., 'npm install @angular/core@20.3.27 @angular/compiler@20.3.27' or corresponding yarn/pnpm equivalent).
Configure static analysis linter rules to flag patterns matching i18n-on* attributes in template HTML structures.
Validate the build logs post-upgrade to confirm that any accidental event-handler translation directives throw compile-time exceptions.

References

Read the full report for CVE-2026-69151 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community