Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the     @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property     bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc,     src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]=value or     bindon-innerHTML=value), the Angular template compiler failed to apply the appropriate schema-derived     sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were     emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly     sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property     to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting     (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. (CVE-2026-54265)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the
    @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property
    bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc,
    src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or
    bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived
    sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were
    emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly
    sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property
    to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting
    (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. (CVE-2026-54265)

ID	Name	Product	Family	Severity
322256	Linux Distros Unpatched Vulnerability : CVE-2026-54265	Nessus	Misc.	medium
443196	SCA: security update for @angular/compiler (GHSA-58w9-8g37-x9v5)	Tenable Cloud Security	SCA Checks	medium
443196	SCA: security update for @angular/compiler (GHSA-58w9-8g37-x9v5)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-54265

medium

Tenable Plugins

medium

medium

medium