High-Severity XSS Vulnerability (CVE-2026-32635) Discovered in Angular Framework A critical Cross-Site Scripting (XSS) vulnerability, CVE-2026-32635, has been identified in Angular, a widely used web application framework. The flaw resides in the framework’s runtime and compiler, specifically affecting internationalization (i18n) attribute bindings. The vulnerability allows attackers to bypass Angular’s built-in sanitization mechanisms, enabling the injection of malicious scripts into web applications. Exploitation occurs when developers combine sensitive HTML attributes (e.g., `href`, `src`, `action`, `background`, `data`, `formaction`) with i18n tags, creating a blind spot in Angular’s security protections. If untrusted user input is bound to these attributes while marked for internationalization, the sanitization process is completely circumvented. With a High severity rating, the flaw has low attack complexity and can be exploited remotely. Successful attacks could lead to: - Session hijacking (theft of cookies/authentication tokens, enabling account takeovers). - Data exfiltration (capture and transmission of sensitive user data to attacker-controlled servers). - Unauthorized actions (manipulation of application functions on behalf of victims). The vulnerability affects @angular/compiler and @angular/core packages across multiple release branches, specifically versions 17.0.0 through 22.0.0-next.2. The Angular team has released patches for the following versions: - 22.0.0-next.3 - 21.2.4 - 20.3.18 - 19.2.20 Legacy versions (17 and 18) remain unpatched, requiring immediate mitigation for affected applications. Recommended workarounds include: - Blocking untrusted input bound to vulnerable attributes. - Removing i18n tags from attributes handling untrusted data. - Enforcing manual sanitization via Angular’s DomSanitizer utility.

High-Severity XSS Vulnerability in Angular Framework Exposes Applications to Malicious Code Execution A critical security flaw, CVE-2026-27970, has been identified in Angular, a widely used web application framework. The vulnerability affects Angular’s internationalization (i18n) pipeline, specifically in how it processes International Components for Unicode (ICU) messages used for complex translations like pluralization or gender-specific phrasing. The issue stems from improper HTML sanitization in translated text. During the i18n workflow, Angular extracts source messages, sends them to third-party translators (often via `.xliff` or `.xtb` files), and reintegrates them into the application. If an attacker compromises these translation files, they can inject malicious JavaScript, which executes when the application renders the tainted content. This Cross-Site Scripting (XSS) vulnerability is rated High severity (CVSS v4: 8.7). Successful exploitation could lead to: - Credential exfiltration: Theft of sensitive data from browser storage (LocalStorage, IndexedDB, cookies) or memory. - Page vandalism: Unauthorized modification of application appearance or behavior. Affected Versions: - ≤ 18.2.14 - 19.0.0-next.0 – 19.2.18 - 20.0.0-next.0 – 20.3.16 - 21.0.0-next.0 – 21.1.5 - 21.2.0-next.0 – 21.2.0-rc.0 Patched Versions: - 19.2.19 - 20.3.17 - 21.1.6 - 21.2.0 For applications unable to update immediately, mitigations include verifying third-party translations, enforcing Content-Security Policy (CSP) controls, and enabling Trusted Types to block unauthorized script execution. The vulnerability underscores the risks of supply-chain attacks via translation pipelines, where compromised external files can serve as an attack vector.

Critical SSRF Vulnerability in Angular SSR Exposes Web Applications to Attack A severe Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2026-27739, has been discovered in Angular’s Server-Side Rendering (SSR) framework. The flaw allows attackers to manipulate HTTP headers and redirect application requests to malicious domains, posing significant risks to affected web applications. ### Root Cause & Exploitation The vulnerability stems from Angular SSR’s insecure handling of user-controlled HTTP headers, particularly the Host and X-Forwarded-* headers. The framework fails to validate whether these headers originate from a trusted source, enabling attackers to: - Manipulate the base origin of the application, causing `HttpClient` to resolve URLs to attacker-controlled servers. - Construct malformed URIs by injecting non-numeric values into the `X-Forwarded-Port` header or unsanitized path segments into `X-Forwarded-Host`. Successful exploitation could lead to: - Credential exfiltration (e.g., Authorization headers, session cookies). - Internal network probing, allowing access to private services, databases, or cloud metadata endpoints. - Data breaches, exposing sensitive server-side information. ### Affected Versions & Mitigation The Angular team has released patched versions to address the flaw: - 21.2.0-rc.1 - 21.1.5 - 20.3.17 - 19.2.21 For organizations unable to upgrade immediately, workarounds include: - Avoiding `req.headers` for URL construction in favor of absolute, trusted base URLs. - Implementing strict header validation middleware in `server.ts` to enforce numeric ports and validated hostnames. The advisory, published on GitHub, underscores the urgency of applying fixes to prevent exploitation.