AIKIDO-2026-10947
@angular/compiler-cli is vulnerable to Cross-site Scripting (XSS)
59
Medium Risk
This Affects:
@angular/compiler-cliTL;DR
Angular template type checking did not consistently apply DOM security schema validation to bound on* attributes in templates and host bindings. Applications could compile bindings to inline event-handler attributes that become XSS vectors when bound data is attacker-influenced. The fix surfaces compile-time errors for disallowed on* attribute and host bindings.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@angular/compiler-cli is vulnerable to Cross-site Scripting (XSS) in versions 21.0.0 - 21.2.12, 20.0.0 - 20.3.19 and 19.0.0 - 19.2.21.
How to fix this
Upgrade the @angular/compiler-cli and/or the @angular/compiler library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant