CVE-2026-50557 Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Attackers can bypass Angular's sanitization using namespaced elements to execute arbitrary JavaScript in the victim's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50557?
CVE-2026-50557 is a medium-severity cross-site scripting vulnerability in angular, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22.
Weakness: CWE-79
Which versions are affected by CVE-2026-50557?
20 open source packages ship an affected version, including @angular/compiler and @angular/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@angular/compiler npm | All versions to 18.2.14 | None |
@angular/compiler npm | All versions to 18.2.14 | None |
@angular/compiler npm | From 19.0.0-next.0 | 19.2.22 |
@angular/compiler npm | From 19.0.0-next.0 | 19.2.22 |
@angular/compiler npm | From 20.0.0-next.0 | 20.3.22 |
@angular/compiler npm | From 20.0.0-next.0 | 20.3.22 |
14 more packages
@angular/compiler npm | From 21.0.0-next.0 | 21.2.15 |
@angular/compiler npm | From 21.0.0-next.0 | 21.2.15 |
@angular/compiler npm | From 22.0.0-next.0 | 22.0.0-rc.2 |
@angular/compiler npm | From 22.0.0-next.0 | 22.0.0-rc.2 |
@angular/core npm | All versions to 18.2.14 | None |
@angular/core npm | All versions to 18.2.14 | None |
@angular/core npm | From 19.0.0-next.0 | 19.2.22 |
@angular/core npm | From 19.0.0-next.0 | 19.2.22 |
@angular/core npm | From 20.0.0-next.0 | 20.3.22 |
@angular/core npm | From 20.0.0-next.0 | 20.3.22 |
@angular/core npm | From 21.0.0-next.0 | 21.2.15 |
@angular/core npm | From 21.0.0-next.0 | 21.2.15 |
@angular/core npm | From 22.0.0-next.0 | 22.0.0-rc.2 |
@angular/core npm | From 22.0.0-next.0 | 22.0.0-rc.2 |
Products include Angular Angular.
How do I fix CVE-2026-50557?
Upgrade @angular/compiler to a fixed version for your release line: 19.2.22, 20.3.22, 21.2.15 or 22.0.0-rc.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-50557 being exploited?
There is no known exploitation of CVE-2026-50557 in the wild and no public exploit code.
Other vulnerabilities in angular
- CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
- CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
- CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-41423 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Sources
Also known as DEBIAN-CVE-2026-50557, GHSA-f3m7-gqxr-g87x, UBUNTU-CVE-2026-50557.