Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

According to its self-reported version number, Angular is 17.x to 18.2.14, 19.x prior to 19.2.20, 20.x prior to 20.3.18 or 21.x prior to 21.2.4. It is, therefore, affected by a Cross-Site Scripting (XSS) vulnerability in @angular/core and @angular/compiler. Enabling internationalization on a security-sensitive attribute (such as href) with an i18n-<attribute> attribute bypasses the built-in sanitization of data bindings. (CVE-2026-32635)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-     Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when     the application uses a security-sensitive attribute (for example href on an anchor tag) together with     Angular's ability to internationalize attributes. Enabling internationalization for the sensitive     attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when     combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious     script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20. (CVE-2026-32635)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-
    Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when
    the application uses a security-sensitive attribute (for example href on an anchor tag) together with
    Angular's ability to internationalize attributes. Enabling internationalization for the sensitive
    attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when
    combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious
    script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20. (CVE-2026-32635)

ID	Name	Product	Family	Type	Severity
115620	Angular 17.0.0 < 19.2.20 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115619	Angular 19.x < 19.2.20 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115618	Angular 20.x < 20.3.18 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115617	Angular 21.x < 21.2.4 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
302510	Linux Distros Unpatched Vulnerability : CVE-2026-32635	Nessus	Misc.	Local	high
438807	SCA: security update for @angular/compiler, @angular/core (GHSA-g93w-mfhg-p222)	Tenable Cloud Security	SCA Checks	Local	high
438807	SCA: security update for @angular/compiler, @angular/core (GHSA-g93w-mfhg-p222)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-32635

high

Tenable Plugins

high

high

high

high

high

high

high