Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization.

According to its self-reported version number, Angular is prior to 19.0.0, 19.x prior to 19.2.19, 20.x prior to 20.3.17 or 21.x prior to 21.1.6. It is, therefore, affected by a Cross-Site Scripting (XSS) vulnerability in the internationalization (i18n) pipeline of @angular/core. HTML content from translated ICU messages is not properly sanitized, allowing a malicious translation to execute arbitrary JavaScript. (CVE-2026-27970)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a
    cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages
    (International Components for Unicode), HTML from translated content was not properly sanitized and could
    execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an
    application in the source language, sending the messages to be translated, and then merging their
    translations back into the final source code. Translations are frequently handled by contracts with
    specific partner companies, and involve sending the source messages to a separate contractor before
    receiving final translations for display to the end user. If the returned translations have malicious
    content, it could be rendered into the application and execute arbitrary JavaScript. When successfully
    exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application
    origin. Depending on the nature of the application being exploited this could lead to credential
    exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must
    compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not
    exploitable by arbitrary users. An attacker must first compromise an application's translation file before
    they can escalate privileges into the Angular application client. The victim application must use Angular
    i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content
    security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is
    applied, developers should consider reviewing and verifying translated content received from untrusted
    third parties before incorporating it in an Angular application, enabling strict CSP controls to block
    unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML
    sanitization. (CVE-2026-27970)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a     cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages     (International Components for Unicode), HTML from translated content was not properly sanitized and could     execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an     application in the source language, sending the messages to be translated, and then merging their     translations back into the final source code. Translations are frequently handled by contracts with     specific partner companies, and involve sending the source messages to a separate contractor before     receiving final translations for display to the end user. If the returned translations have malicious     content, it could be rendered into the application and execute arbitrary JavaScript. When successfully     exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application     origin. Depending on the nature of the application being exploited this could lead to credential     exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must     compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not     exploitable by arbitrary users. An attacker must first compromise an application's translation file before     they can escalate privileges into the Angular application client. The victim application must use Angular     i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content     security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is     applied, developers should consider reviewing and verifying translated content received from untrusted     third parties before incorporating it in an Angular application, enabling strict CSP controls to block     unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML     sanitization. (CVE-2026-27970)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115624	Angular < 19.2.19 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115623	Angular 19.x < 19.2.19 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115622	Angular 20.x < 20.3.17 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115621	Angular 21.x < 21.1.6 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
438037	SCA: security update for @angular/core (GHSA-prjf-86w9-mfqv)	Tenable Cloud Security	SCA Checks	Local	high
438037	SCA: security update for @angular/core (GHSA-prjf-86w9-mfqv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
300236	Linux Distros Unpatched Vulnerability : CVE-2026-27970	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-27970

high

Tenable Plugins

high

high

high

high

high

high

high