Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@angular/core

9 known vulnerabilities (5 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 5 high, 3 medium, 1 low
Weekly downloads
8.3M
Dependents
463
Registry
npm

Advisories 9

  • CVE-2026-88057Medium 5.3

    Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

    Affected: from 22.0.0, fixed in 22.1.0; from 21.0.0, fixed in 21.2.20; from 20.0.0, fixed in 20.3.28; through 19.2.25.

  • Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

    Affected: from 22.0.0-next.0, fixed in 22.0.1; from 21.0.0-next.0, fixed in 21.2.19; from 20.0.0-next.0, fixed in 20.3.27; through 19.2.25.

  • Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

    Affected: from 22.0.0-next.0, fixed in 22.0.1; from 21.0.0-next.0, fixed in 21.2.17; from 20.0.0-next.0, fixed in 20.3.25; through 19.2.25.

  • CVE-2026-52725Medium 5.3

    Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

    Affected: from 21.0.0-next.0, fixed in 21.2.15; from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 19.0.0-next.0, fixed in 19.2.23; through 18.2.14; from 20.0.0-next.0, fixed in 20.3.22.

  • CVE-2026-50557Medium 5.3

    Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

    Affected: from 21.0.0-next.0, fixed in 21.2.15; from 22.0.0-next.0, fixed in 22.0.0-rc.2; from 20.0.0-next.0, fixed in 20.3.22; from 19.0.0-next.0, fixed in 19.2.22; through 18.2.14.

  • Angular has XSS in i18n attribute bindings

    Affected: from 22.0.0-next.0, fixed in 22.0.0-next.3; from 21.0.0-next.0, fixed in 21.2.4; from 20.0.0-next.0.0.0, fixed in 20.3.18; from 19.0.0-next.0, fixed in 19.2.20; from 17.0.0-next.0, through 18.2.14.

  • Angular i18n vulnerable to Cross-Site Scripting (XSS)

    Affected: from 21.2.0-next.0, fixed in 21.2.0; from 21.0.0-next.0, fixed in 21.1.6; from 20.0.0-next.0, fixed in 20.3.17; from 19.0.0-next.0, fixed in 19.2.19; through 18.2.14.

  • Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    Affected: from 21.1.0-next.0, fixed in 21.1.0-rc.0; from 21.0.0-next.0, fixed in 21.0.7; from 20.0.0-next.0, fixed in 20.3.16; from 19.0.0-next.0, fixed in 19.2.18; through 18.2.14.

  • Angular Comment cross site scripting

    Affected: from 11.0.0, fixed in 11.0.5; from 11.1.0-next.0, fixed in 11.1.0-next.3; fixed in 10.2.5.