CVE-2026-22610: Angular

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

Affected products

• Angular Angular: up to and including 18.2.14; from 19.0.0, before 19.2.18 (fixed in 19.2.18); from 20.0.0, before 20.3.16 (fixed in 20.3.16); from 21.0.0, before 21.0.7 (fixed in 21.0.7); version 21.1.0 only

Published 2026-01-10. Last modified 2026-06-17.