8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32635

CVE-2026-32635: Angular vulnerable to XSS in i18n attribute bindings

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.

The following example illustrates the issue:

<a href="{{maliciousUrl}}" i18n-href>Click me</a>

The following attributes have been confirmed to be vulnerable:

action
background
cite
codebase
data
formaction
href
itemtype
longdesc
poster
src
xlink:href

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

Session Hijacking: Stealing session cookies and authentication tokens.
Data Exfiltration: Capturing and transmitting sensitive user data.
Unauthorized Actions: Performing actions on behalf of the user.

Attack Preconditions

The application must use a vulnerable version of Angular.
The application must bind unsanitized user input to one of the attributes mentioned above.
The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.

Patches

22.0.0-next.3

Miggo Vulnerability Database

→

CVE-2026-32635

CVE-2026-32635:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/core	npm	>= 22.0.0-next.0, < 22.0.0-next.3	22.0.0-next.3
@angular/core	npm	>= 21.0.0-next.0, < 21.2.4	21.2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Angular's internationalization (i18n) feature for attributes bypassed its built-in sanitization mechanisms for security-sensitive attributes like href and src. The analysis of the provided patches confirms this.

Commit 8630319f74c9575a21693d875cc7d5252516146d: This commit patches the @angular/core package. The changes in packages/core/src/render3/i18n/i18n_parse.ts show that sanitization was not being applied during the processing of i18n attributes. Specifically, the functions i18nAttributesFirstPass and walkIcuTree were modified to add a _sanitizeUrl function call where it was previously missing (null). This directly addresses the vulnerability where a binding like href="{{maliciousUrl}}" with an i18n-href attribute would not be sanitized.
Commit 78dea55351fb305b33a919c43a6b363137eca166: This commit patches the @angular/compiler package. It adds 'iframe|src' to the TRUSTED_TYPES_SINKS set in packages/compiler/src/schema/trusted_types_sinks.ts. This set is used to identify attributes that are sinks for DOM XSS and require Trusted Types. By adding 'iframe|src', the compiler is now aware that the src attribute of an iframe is a security-sensitive attribute that needs to be handled with care during i18n compilation, preventing the injection of malicious URLs.

In summary, the root cause is a failure to apply sanitization to data-bound, internationalized attributes. An attacker could exploit this by providing a malicious URL (e.g., javascript:alert(1)) which would then be rendered unsanitized, leading to Cross-Site Scripting (XSS). The identified functions are central to the processing and compilation of these vulnerable attributes.

Vulnerable functions

i18nAttributesFirstPass

packages/core/src/render3/i18n/i18n_parse.ts

This function is responsible for the first pass of processing i18n attributes. The patch adds a sanitizer to the `allocTNode` call, which was previously `null`. This indicates that attributes that should have been sanitized were not, allowing for potential XSS when combined with user-provided data and i18n attributes.

walkIcuTree

packages/core/src/render3/i18n/i18n_parse.ts

This function walks through the ICU (Internationalization Component Utilities) expression tree. The patch modifies the call to `generateBindingUpdateOpCodes` to conditionally apply a URL sanitizer. The previous logic was flawed, leading to a lack of sanitization for certain attribute bindings within i18n blocks.

isTrustedTypesSink

packages/compiler/src/schema/trusted_types_sinks.ts

While not a direct code change in the function itself, the `TRUSTED_TYPES_SINKS` set that `isTrustedTypesSink` uses was modified to include 'iframe|src'. This indicates that the compiler previously did not consider the 'src' attribute of an iframe as a potential security sink when used with i18n, thus not enforcing Trusted Types and allowing for potential XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-32635: Angular vulnerable to XSS in i18n attribute bindings

Impact

Attack Preconditions

Patches

CVE-2026-32635:

8.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-32635: Angular vulnerable to XSS in i18n attribute bindings

Impact

Attack Preconditions

Patches

Technical Details

Workarounds

References

8.6

8.6

Basic Information

Basic Information

8.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-32635: Angular vulnerable to XSS in i18n attribute bindings

Impact

Attack Preconditions

Patches

CVE-2026-32635:

8.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-32635: Angular vulnerable to XSS in i18n attribute bindings

Impact

Attack Preconditions

Patches

Technical Details

Workarounds

References

8.6

8.6

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI