AIKIDO-2026-461187
@angular/core is vulnerable to Cross-Site Scripting (XSS)
53
Medium Risk
This Affects:
@angular/coreTL;DR
Angular resolves the security context used to sanitize directive host bindings from the directive selector rather than the concrete host element the directive is applied to. When the same directive is applied to different host elements through host-directive composition, inheritance, dynamic component instantiation, SVG or MathML namespaces, or tag-neutral selectors, security-sensitive DOM properties receive the wrong sanitizer or none at all. Values bound to those host bindings that come from untrusted input can then inject and run arbitrary JavaScript in the page. The fix resolves security contexts against the actual host element so that URL, resource-URL, HTML, and related bindings are sanitized correctly.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application binds untrusted, user-controlled values to security-sensitive directive host bindings (for example URL, resource-URL, or HTML properties) applied to concrete host elements.
Background info
@angular/core is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 20.3.27, 21.0.0 - 21.2.19 and 22.0.0 - 22.0.8.
How to fix this
Upgrade the @angular/core and/or the @angular/compiler library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant