Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-03T16:23:34 @angular/compiler: @angular/core: Angular: Cross-Site Scripting via internationalization event handlers 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CWE-79

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

A flaw was found in the Angular compiler's internationalization (i18n) pipeline. This vulnerability allows a lower-trust translation file to replace a static event handler with executable JavaScript. A remote attacker could exploit this by injecting malicious scripts, leading to Cross-Site Scripting (XSS). This could result in unauthorized access to sensitive information or actions performed on behalf of the user.

Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-rhel9 Red Hat build of Apicurio Registry 3 Affected apicurio/apicurio-registry-ui-rhel8 Red Hat Ceph Storage 4 Affected ceph Red Hat Enterprise Linux 10 Affected ceph Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Not affected gjs Red Hat Enterprise Linux 10 Affected intel-cmt-cat Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 8 Not affected dotnet5.0-build-reference-packages Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected intel-cmt-cat Red Hat Enterprise Linux 8 Not affected mozjs60 Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected ceph Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Not affected gjs Red Hat Enterprise Linux 9 Affected intel-cmt-cat Red Hat Enterprise Linux 9 Affected thunderbird https://www.cve.org/CVERecord?id=CVE-2026-69151 https://nvd.nist.gov/vuln/detail/CVE-2026-69151 https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865 https://github.com/angular/angular/pull/68821 https://github.com/angular/angular/pull/69306 https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99