Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Timeline

1. Jun 22, 2026, 3:18 PM UTCCVE published
2. Jun 22, 2026, 3:59 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 22, 2026, 3:59 PM UTCRecord last updated

Affected versions

• angular angular

  through 18.2.14

• @angular/corenpm

  From 21.0.0-next.0 · fixed in 21.2.15

• @angular/corenpm

  From 22.0.0-next.0 · fixed in 22.0.0-rc.2

• @angular/corenpm

  From 19.0.0-next.0 · fixed in 19.2.23

• @angular/corenpm

  through 18.2.14

• @angular/corenpm

  From 20.0.0-next.0 · fixed in 20.3.22

References 3