Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.27, 21.x prior to 21.2.19 or 22.x prior to 22.0.1. It is, therefore, affected by multiple vulnerabilities:

- A Cross-Site Scripting (XSS) vulnerability in the internationalization (i18n) pipeline of @angular/compiler. Event-handler attributes (such as onerror) can be marked for translation using i18n-on* attributes, allowing a malicious translation file to inject arbitrary JavaScript in the localized build. (CVE-2026-69151)

- An information disclosure vulnerability in @angular/service-worker. Sensitive request headers (such as Authorization) are not stripped on cross-origin redirects, allowing a remote attacker to obtain credentials by triggering a redirect to an untrusted origin. (CVE-2026-54264)

- A denial of service vulnerability in the formatDate function of @angular/common, also used by DatePipe. The length of the format parameter is not validated, allowing an excessively long format string to cause uncontrolled CPU and memory consumption. (CVE-2026-54268)

- A DOM clobbering vulnerability in the client hydration of @angular/core. The serialized transfer state is looked up using the predictable ng-state element identifier, allowing an attacker able to inject an element with this identifier to poison the hydration response cache. (CVE-2026-54267)

- A weak cache key hashing vulnerability in the HttpTransferCache of @angular/common. Cache keys are generated with a 32-bit hash, allowing an attacker to craft colliding request parameters so that an attacker-controlled response overwrites the response of a sensitive endpoint during SSR, leading to data leakage or state poisoning. (CVE-2026-54266)

- A sanitization bypass vulnerability in @angular/compiler. Security-sensitive native DOM properties (such as innerHTML, src or href) bound using the two-way binding syntax are emitted without sanitizer, leading to Cross-Site Scripting (XSS). (CVE-2026-54265)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler
    i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust
    translation file to replace a static handler with executable JavaScript. This issue is fixed in versions
    20.3.27, 21.2.19, and 22.0.1. (CVE-2026-69151)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler     i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust     translation file to replace a static handler with executable JavaScript. This issue is fixed in versions     20.3.27, 21.2.19, and 22.0.1. (CVE-2026-69151)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115600	Angular < 20.3.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115599	Angular 20.x < 20.3.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115598	Angular 21.x < 21.2.19 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115597	Angular 22.x < 22.0.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
445586	SCA: security update for @angular/compiler, @angular/core (GHSA-jj27-h5hq-8x99)	Tenable Cloud Security	SCA Checks	Local	high
445586	SCA: security update for @angular/compiler, @angular/core (GHSA-jj27-h5hq-8x99)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331797	Linux Distros Unpatched Vulnerability : CVE-2026-69151	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-69151

high

Tenable Plugins

high

high

high

high

high

high

high