AIKIDO-2026-618845
@angular/core is vulnerable to Cross-Site Scripting (XSS)
53
Medium Risk
This Affects:
@angular/coreTL;DR
Angular's dynamic component creation API infers a component's host element from the component selector when no explicit host node is provided. The guard that rejects <script> tags as host elements runs only for explicitly located hosts, so a component whose inferred host resolves to a script element is still mounted. When an application passes attacker-influenced selectors or host values to createComponent, a component can be mounted onto a script-executing host, enabling Cross-Site Scripting. The fix moves the script-host rejection into ComponentFactory so both the explicit and the inferred host paths are validated consistently.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes user-controlled selectors or host elements to dynamic component creation APIs.
Background info
@angular/core is vulnerable to Cross-Site Scripting (XSS) in versions 20.0.0 - 20.3.25, 21.0.0 - 21.2.17 and 22.0.0 - 22.0.4.
How to fix this
Upgrade the @angular/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant