6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27970

CVE-2026-27970: Angular i18n vulnerable to Cross-Site Scripting

A Cross-site Scripting (XSS) vulnerability has been identified in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript.

Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user.

If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript.

Impact

When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to:

Credential Exfiltration: Stealing sensitive user data stored in page memory, LocalStorage, IndexedDB, or cookies available to JS and sending them to an attacker controlled server.
Page Vandalism: Mutating the page to read or act differently than intended by the developer.

Attach Preconditions

The attacker must compromise the translation file (xliff, xtb, etc.).
Unlike most XSS vulnerabilities, this one is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client.
The victim application must use Angular i18n.
The victim application must use one or more ICU messages.
The victim application must render an ICU message.
The victim application must not defend against XSS via a safe Content-Security Policy (CSP) or Trusted Types.

Patches

21.2.0
21.1.6
20.3.17
19.2.19

Workarounds

Until the patch is applied, developers should consider:

Reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application.
Enabling strict CSP controls to block unauthorized JavaScript from executing on the page.
Enabling Trusted Types to enforce proper HTML sanitization.

References

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27970

CVE-2026-27970:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/core	npm	>= 21.2.0-next.0, <= 21.2.0-rc.0	21.2.0
@angular/core	npm	>= 21.0.0-next.0, <= 21.1.5	21.1.6
@angular/core	npm	>= 20.0.0-next.0, <= 20.3.16	20.3.17
@angular/core	npm	>= 19.0.0-next.0, <= 19.2.18	19.2.19
@angular/core	npm	<= 18.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue within the Angular internationalization (i18n) pipeline. The root cause is the improper handling of HTML content embedded within ICU messages that are provided in translation files (e.g., XLIFF, XTB). An attacker who can compromise these translation files can inject malicious HTML.

The analysis of the security patches, particularly commit 306f367899dfc2e04238fecd3455547b5d54075d, reveals that the core of the vulnerability lies in the walkIcuTree function located in packages/core/src/render3/i18n/i18n_parse.ts. This function is responsible for parsing the ICU messages and generating internal rendering instructions for Angular.

Before the fix, walkIcuTree operated on a flawed assumption: it considered any attribute within the translated HTML to be safe as long as it didn't contain an Angular data binding. This meant that if a translator (or an attacker posing as one) included an attribute like <a href="javascript:alert('XSS')">, the function would process it without sanitization. The addCreateAttribute helper function would then be called to create the rendering instruction for this malicious attribute.

At runtime, when the Angular application would render the internationalized component, these instructions would be executed, creating the malicious element in the DOM and triggering the XSS payload.

The patch addresses this by fundamentally changing the trust model. The updated walkIcuTree function now validates all attributes against an allowlist (VALID_ATTRS). For attributes that are known to accept URIs (URI_ATTRS), it blocks any value from being set, effectively neutralizing any attempt to inject javascript: or other malicious URIs. Any attribute not on the allowlist is simply ignored. This ensures that only known, safe attributes are rendered from translated content, mitigating the XSS risk.

Vulnerable functions

walkIcuTree

packages/core/src/render3/i18n/i18n_parse.ts

The `walkIcuTree` function is responsible for parsing HTML embedded within i18n ICU messages. Prior to the patch, this function incorrectly assumed that any HTML attribute that did not contain a data binding was safe. This allowed it to process and create rendering instructions for any attribute provided in a translated message. An attacker with the ability to modify translation files could inject malicious attributes (e.g., `href` with a `javascript:` URI) into the ICU message. When this message was rendered by the Angular application, the malicious script would execute, leading to a Cross-Site Scripting (XSS) vulnerability. The patch fixes this by introducing an allowlist for attributes and explicitly blocking sensitive URI attributes.

addCreateAttribute

packages/core/src/render3/i18n/i18n_parse.ts

This helper function was used by `walkIcuTree` to generate the operation codes for attribute creation. The vulnerable version of this function accepted an `Attr` object and would unquestioningly use its `name` and `value` properties. This design was complicit in the XSS vulnerability because it provided no mechanism for sanitization; it simply processed the data it was given by `walkIcuTree`. The function was refactored to accept `attrName` and `attrValue` as separate string arguments, enabling the calling function (`walkIcuTree`) to perform sanitization before passing the values.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.