Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@angular/compiler

7 known vulnerabilities (4 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 4 high, 3 medium
Weekly downloads
8.1M
Dependents
251
Registry
npm

Advisories 7

  • CVE-2026-88057Medium 5.3

    Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

    Affected: from 22.0.0, fixed in 22.1.0; from 21.0.0, fixed in 21.2.20; from 20.0.0, fixed in 20.3.28; through 19.2.25.

  • Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

    Affected: from 22.0.0-next.0, fixed in 22.0.1; from 21.0.0-next.0, fixed in 21.2.19; from 20.0.0-next.0, fixed in 20.3.27; through 19.2.25.

  • CVE-2026-54265Medium 5.3

    Angular: Two-Way Property Binding Sanitization Bypass (XSS)

    Affected: from 22.0.0-next.0, fixed in 22.0.1; from 21.0.0-next.0, fixed in 21.2.17; from 20.0.0-next.0, fixed in 20.3.25; through 19.2.25.

  • CVE-2026-50557Medium 5.3

    Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

    Affected: from 21.0.0-next.0, fixed in 21.2.15; from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 20.0.0-next.0, fixed in 20.3.22; from 19.0.0-next.0, fixed in 19.2.22; through 18.2.14.

  • Angular has XSS in i18n attribute bindings

    Affected: from 22.0.0-next.0, fixed in 22.0.0-next.3; from 21.0.0-next.0, fixed in 21.2.4; from 20.0.0-next.0.0.0, fixed in 20.3.18; from 19.0.0-next.0, fixed in 19.2.20; from 17.0.0-next.0, through 18.2.14.

  • Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    Affected: from 21.1.0-next.0, fixed in 21.1.0-rc.0; from 21.0.0-next.0, fixed in 21.0.7; from 20.0.0-next.0, fixed in 20.3.16; from 19.0.0-next.0, fixed in 19.2.18; through 18.2.14.

  • Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

    Affected: from 21.0.0-next.0, fixed in 21.0.2; from 20.0.0-next.0, fixed in 20.3.15; from 19.0.0-next.0, fixed in 19.2.17; through 18.2.14.