8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22610

CVE-2026-22610: Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22610

CVE-2026-22610:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/compiler	npm	>= 21.1.0-next.0, < 21.1.0-rc.0	21.1.0-rc.0
@angular/core	npm	>= 21.1.0-next.0, < 21.1.0-rc.0	21.1.0-rc.0
@angular/compiler	npm	>= 21.0.0-next.0, < 21.0.7	21.0.7
@angular/core	npm	>= 21.0.0-next.0, < 21.0.7	21.0.7
@angular/compiler	npm	>= 20.0.0-next.0, < 20.3.16	20.3.16
@angular/core	npm	>= 20.0.0-next.0, < 20.3.16	20.3.16
@angular/compiler	npm	>= 19.0.0-next.0, < 19.2.18	19.2.18
@angular/core	npm	>= 19.0.0-next.0, < 19.2.18	19.2.18
@angular/compiler	npm	<= 18.2.14
@angular/core	npm	<= 18.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Angular's sanitization mechanism, specifically in how it handles attributes of SVG elements. The provided patch in pull request #66318 clearly shows the fix in the getUrlSanitizer function located in packages/core/src/sanitization/sanitization.ts. Before the patch, this function did not recognize href or xlink:href on an SVG <script> tag as a context requiring strict resource URL sanitization. The patch rectifies this by adding logic to identify this specific combination and apply the appropriate sanitizer (ɵɵsanitizeResourceUrl). The change in packages/compiler/src/schema/dom_security_schema.ts is a related part of the fix, updating the schema that the compiler uses, but getUrlSanitizer is the function that would be invoked at runtime to make the sanitization decision. Therefore, getUrlSanitizer is the key vulnerable function that, when exploited, would be part of the execution flow leading to the XSS.

Vulnerable functions

getUrlSanitizer

packages/core/src/sanitization/sanitization.ts

The `getUrlSanitizer` function was vulnerable because it did not correctly identify the `href` and `xlink:href` attributes of an SVG `<script>` element as needing resource URL sanitization. The function's logic only considered `href` on `<base>` and `<link>` tags as resource URLs. This allowed an attacker to bypass sanitization and inject a malicious script via data binding to these attributes, leading to a Cross-Site Scripting (XSS) vulnerability. The patch added a check for `script` tags with `href` and `xlink:href` attributes to ensure they are properly sanitized as resource URLs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.