CVE-2026-54265
Severity CVSS v4.0:
MEDIUM
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
22/06/2026
Last modified:
09/07/2026
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.
Impact
Base Score 4.0
5.30
Severity 4.0
MEDIUM
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* | 19.2.25 (including) | |
| cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* | 20.0.0 (including) | 20.3.25 (excluding) |
| cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* | 21.0.0 (including) | 21.2.17 (excluding) |
| cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* | 22.0.0 (including) | 22.0.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page