AIKIDO-2026-10829
@angular/core is vulnerable to Cross-site Scripting (XSS)
68
Medium Risk
This Affects:
@angular/coreTL;DR
The attribute pipeline previously consulted an event-attribute helper only inside development-only branches while still routing values into setElementAttribute for real renders. The runtime path now relies on compile-time and schema enforcement so on*-style attributes are not accepted through the host-attribute instruction path intended for production bundles. Supporting integration tests were updated to match compile-time failure behavior instead of expecting late runtime rejection alone.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@angular/core is vulnerable to Cross-site Scripting (XSS) in versions 21.0.0 - 21.2.12.
How to fix this
Upgrade the @angular/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant