Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @angular/compiler | npm | >= 22.0.0-next.0, < 22.0.1 | 22.0.1 |
| @angular/compiler | npm | >= 21.0.0-next.0, < 21.2.19 | 21.2.19 |
| @angular/compiler | npm | >= 20.0.0-next.0, < 20.3.27 | 20.3.27 |
| @angular/compiler | npm | <= 19.2.25 | |
| @angular/core | npm | >= 22.0.0-next.0, < 22.0.1 | 22.0.1 |
| @angular/core | npm | >= 21.0.0-next.0, < 21.2.19 | 21.2.19 |
| @angular/core | npm | >= 20.0.0-next.0, < 20.3.27 | 20.3.27 |
| @angular/core | npm | <= 19.2.25 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the Angular compiler's internationalization (i18n) pipeline. The core of the issue lies in the I18nMetaVisitor class, which is responsible for traversing the HTML abstract syntax tree (AST) and collecting metadata for translation. The provided patches clearly point to the visitElement method within this class.
The first commit, 6c41f5ca01c0ae045fc7d929b72853a11eb55865, introduces a check to explicitly disallow any attribute starting with on from being marked for translation. This check was added to the attribute processing loop inside the visitElement method. The absence of this check is the root cause of the vulnerability, as it allowed attributes like onerror to be processed by the i18n pipeline.
The second commit, 417a4071a776464d549509ed3aec121dbd2fda5e, refines this check by introducing a helper function isPossibleEventHandler to avoid incorrectly blocking valid attributes like on="some-value". This further confirms that the logic for handling these attributes resides within I18nMetaVisitor.visitElement.
Therefore, I18nMetaVisitor.visitElement is the primary vulnerable function. During the compilation phase, this function would process the dangerous template syntax, and its lack of validation is what enables the XSS attack when a malicious translation file is later used.
I18nMetaVisitor.visitElementpackages/compiler/src/render3/view/i18n/meta.ts