https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 04 Aug 2026 19:56:59 +0000 https://vulnerability.circl.lu/sighting/6058a6b7-4a95-44d0-b666-274527705da6/export {"uuid": "6058a6b7-4a95-44d0-b666-274527705da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://gist.github.com/alon710/bdd530b55ab23396bc2ee2dc380962dc", "content": "# CVE-2026-69151: CVE-2026-69151: Stored Cross-Site Scripting (XSS) in Angular Compiler i18n Pipeline via Event-Handler Attributes\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69151\n\n## Summary\nA high-severity security vulnerability has been identified within the Angular compiler's internationalization (i18n) metadata collection and translation pipeline. Angular implements strict defenses against client-side execution injection by validating standard attribute and property bindings. However, when parsing elements containing both i18n translation attributes and inline event-handler elements (such as `i18n-onerror`), the compiler failed to assert the safety of the target attribute. Consequently, compromised or untrusted localization translation source files can supply arbitrary JavaScript payloads that replace static event-handler bindings. This arbitrary code is compiled directly into the localized build bundle and executed dynamically by the web browser, bypassing runtime sanitization, security checks, and standard binding constraints.\n\n## TL;DR\nAn input validation flaw in the Angular compiler's i18n translation metadata pipeline enables unauthenticated stored Cross-Site Scripting (XSS) when utilizing untrusted translation assets. Attackers who compromise translation databases or localization files can inject arbitrary JavaScript executable payloads into translated attributes like `i18n-onerror`. Standard Angular runtime property-binding security validations fail to catch this injection because the malicious payloads are rendered as static attributes in the compiled HTML document, enabling full client-side session compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n- **Attack Vector**: Network / Content Supply Chain Injection\n- **Attack Complexity**: Low (No special conditions required)\n- **Authentication Requirements**: None (Requires access to influence external translation resources)\n- **CVSS v4.0 Base Score**: 7.6 (High)\n- **Exploit Status**: Proof-of-Concept (No known active exploitation in the wild)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Angular compiler (@angular/compiler)\n- Angular core runtime (@angular/core)\n- **@angular/compiler**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/compiler**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/compiler**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n- **@angular/core**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/core**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/core**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n\n## Mitigation\n\n- Upgrade Angular compiler and core libraries to patched versions (20.3.27, 21.2.19, or 22.0.1)\n- Audit existing HTML templates to ensure event handlers are never marked for translation via i18n-on* attributes\n- Treat translation metadata files (XLF, XLIFF, JSON) as high-risk assets and enforce strict code review pipelines\n- Enforce a rigorous Content Security Policy (CSP) that bans the 'unsafe-inline' script directive\n\n**Remediation Steps:**\n1. Open the project package.json file and identify the versions of @angular/compiler and @angular/core.\n2. Execute the update command matching your current release branch (e.g., 'npm install @angular/core@20.3.27 @angular/compiler@20.3.27' or corresponding yarn/pnpm equivalent).\n3. Configure static analysis linter rules to flag patterns matching i18n-on* attributes in template HTML structures.\n4. Validate the build logs post-upgrade to confirm that any accidental event-handler translation directives throw compile-time exceptions.\n\n## References\n\n- [NVD CVE Record - CVE-2026-69151](https://www.cve.org/CVERecord?id=CVE-2026-69151)\n- [GitHub Security Advisory GHSA-jj27-h5hq-8x99](https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99)\n- [Angular Git Core Fix Commit](https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865)\n- [Angular Git Follow-up Refinement Commit](https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69151) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T19:31:37.187220Z"} {"uuid": "6058a6b7-4a95-44d0-b666-274527705da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://gist.github.com/alon710/bdd530b55ab23396bc2ee2dc380962dc", "content": "# CVE-2026-69151: CVE-2026-69151: Stored Cross-Site Scripting (XSS) in Angular Compiler i18n Pipeline via Event-Handler Attributes\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69151\n\n## Summary\nA high-severity security vulnerability has been identified within the Angular compiler's internationalization (i18n) metadata collection and translation pipeline. Angular implements strict defenses against client-side execution injection by validating standard attribute and property bindings. However, when parsing elements containing both i18n translation attributes and inline event-handler elements (such as `i18n-onerror`), the compiler failed to assert the safety of the target attribute. Consequently, compromised or untrusted localization translation source files can supply arbitrary JavaScript payloads that replace static event-handler bindings. This arbitrary code is compiled directly into the localized build bundle and executed dynamically by the web browser, bypassing runtime sanitization, security checks, and standard binding constraints.\n\n## TL;DR\nAn input validation flaw in the Angular compiler's i18n translation metadata pipeline enables unauthenticated stored Cross-Site Scripting (XSS) when utilizing untrusted translation assets. Attackers who compromise translation databases or localization files can inject arbitrary JavaScript executable payloads into translated attributes like `i18n-onerror`. Standard Angular runtime property-binding security validations fail to catch this injection because the malicious payloads are rendered as static attributes in the compiled HTML document, enabling full client-side session compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n- **Attack Vector**: Network / Content Supply Chain Injection\n- **Attack Complexity**: Low (No special conditions required)\n- **Authentication Requirements**: None (Requires access to influence external translation resources)\n- **CVSS v4.0 Base Score**: 7.6 (High)\n- **Exploit Status**: Proof-of-Concept (No known active exploitation in the wild)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Angular compiler (@angular/compiler)\n- Angular core runtime (@angular/core)\n- **@angular/compiler**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/compiler**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/compiler**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n- **@angular/core**: < 20.3.27 (Fixed in: `20.3.27`)\n- **@angular/core**: >= 21.0.0-next.0, < 21.2.19 (Fixed in: `21.2.19`)\n- **@angular/core**: >= 22.0.0-next.0, < 22.0.1 (Fixed in: `22.0.1`)\n\n## Mitigation\n\n- Upgrade Angular compiler and core libraries to patched versions (20.3.27, 21.2.19, or 22.0.1)\n- Audit existing HTML templates to ensure event handlers are never marked for translation via i18n-on* attributes\n- Treat translation metadata files (XLF, XLIFF, JSON) as high-risk assets and enforce strict code review pipelines\n- Enforce a rigorous Content Security Policy (CSP) that bans the 'unsafe-inline' script directive\n\n**Remediation Steps:**\n1. Open the project package.json file and identify the versions of @angular/compiler and @angular/core.\n2. Execute the update command matching your current release branch (e.g., 'npm install @angular/core@20.3.27 @angular/compiler@20.3.27' or corresponding yarn/pnpm equivalent).\n3. Configure static analysis linter rules to flag patterns matching i18n-on* attributes in template HTML structures.\n4. Validate the build logs post-upgrade to confirm that any accidental event-handler translation directives throw compile-time exceptions.\n\n## References\n\n- [NVD CVE Record - CVE-2026-69151](https://www.cve.org/CVERecord?id=CVE-2026-69151)\n- [GitHub Security Advisory GHSA-jj27-h5hq-8x99](https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99)\n- [Angular Git Core Fix Commit](https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865)\n- [Angular Git Follow-up Refinement Commit](https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69151) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T19:31:37.187220Z"} https://vulnerability.circl.lu/sighting/6058a6b7-4a95-44d0-b666-274527705da6/export Mon, 03 Aug 2026 19:31:37 +0000 https://vulnerability.circl.lu/sighting/cdfb620f-277f-43c0-91e2-63bd0bc2361b/export {"uuid": "cdfb620f-277f-43c0-91e2-63bd0bc2361b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/cpivbdhgtqa6k", "content": "CVE-2026-69151 - Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes\nCVE ID : CVE-2026-69151\n \n Published : Aug. 3, 2026, 5:16 p.m. | 41\u00a0minutes ago\n \n Description : Angular is a development platform for building mobile and desktop web applications using Type...", "creation_timestamp": "2026-08-03T18:20:14.070826Z"} {"uuid": "cdfb620f-277f-43c0-91e2-63bd0bc2361b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/cpivbdhgtqa6k", "content": "CVE-2026-69151 - Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes\nCVE ID : CVE-2026-69151\n \n Published : Aug. 3, 2026, 5:16 p.m. | 41\u00a0minutes ago\n \n Description : Angular is a development platform for building mobile and desktop web applications using Type...", "creation_timestamp": "2026-08-03T18:20:14.070826Z"} https://vulnerability.circl.lu/sighting/cdfb620f-277f-43c0-91e2-63bd0bc2361b/export Mon, 03 Aug 2026 18:20:14 +0000 https://vulnerability.circl.lu/sighting/02150ce7-9740-415e-8045-30438836d805/export {"uuid": "02150ce7-9740-415e-8045-30438836d805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6xhvahdl2o", "content": "CVE-2026-69151 - compiler\nA security issue in Angular's internationalization (i18n) feature allows hackers to inject malicious JavaScript code into web pages. This can happen if an attacker controls\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#compiler #angular #npm #CVE #infosec", "creation_timestamp": "2026-08-03T16:52:06.541925Z"} {"uuid": "02150ce7-9740-415e-8045-30438836d805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69151", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6xhvahdl2o", "content": "CVE-2026-69151 - compiler\nA security issue in Angular's internationalization (i18n) feature allows hackers to inject malicious JavaScript code into web pages. This can happen if an attacker controls\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#compiler #angular #npm #CVE #infosec", "creation_timestamp": "2026-08-03T16:52:06.541925Z"} https://vulnerability.circl.lu/sighting/02150ce7-9740-415e-8045-30438836d805/export Mon, 03 Aug 2026 16:52:06 +0000