CVE-2026-27970

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27970", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:24:57.793Z", "datePublished": "2026-02-26T02:03:43.811Z", "dateUpdated": "2026-07-15T01:12:09.680Z"}, "containers": {"cna": {"title": "Angular i18n vulnerable to Cross-Site Scripting (XSS)", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv"}, {"name": "https://github.com/angular/angular/pull/67183", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/pull/67183"}, {"name": "https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d"}, {"name": "https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232"}, {"name": "https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93"}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"version": ">= 21.2.0-next.0, < 21.2.0", "status": "affected"}, {"version": ">= 21.0.0-next.0, < 21.1.6", "status": "affected"}, {"version": ">= 20.0.0-next.0, < 20.3.17", "status": "affected"}, {"version": ">= 19.0.0-next.0, < 19.2.19", "status": "affected"}, {"version": "<= 18.2.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:03:43.811Z"}, "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization."}], "source": {"advisory": "GHSA-prjf-86w9-mfqv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T14:47:13.378204Z", "id": "CVE-2026-27970", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:47:38.387Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/volsync-operator-bundle", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/volsync-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "ceph", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "gjs", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "intel-cmt-cat", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "dotnet5.0-build-reference-packages", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "intel-cmt-cat", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "mozjs60", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ceph", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "gjs", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "intel-cmt-cat", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "polkit", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "io.apicurio-apicurito", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "io.syndesis-syndesis-parent", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-kf-notebook-controller-rhel8", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-notebook-controller-rhel8", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "datePublic": "2026-02-26T02:03:43.811Z", "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-27970"}, {"name": "RHBZ#2442934", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442934"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27970.json"}], "timeline": [{"lang": "en", "time": "2026-02-26T03:01:37.601Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-26T02:03:43.811Z", "value": "Made public."}], "title": "@angular/core: Angular: Cross-site scripting via compromised translation files", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:12:09.680Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27970", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T14:47:13.378204Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:47:32.718Z"}}], "cna": {"title": "Angular i18n vulnerable to Cross-Site Scripting (XSS)", "source": {"advisory": "GHSA-prjf-86w9-mfqv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "angular", "product": "angular", "versions": [{"status": "affected", "version": ">= 21.2.0-next.0, < 21.2.0"}, {"status": "affected", "version": ">= 21.0.0-next.0, < 21.1.6"}, {"status": "affected", "version": ">= 20.0.0-next.0, < 20.3.17"}, {"status": "affected", "version": ">= 19.0.0-next.0, < 19.2.19"}, {"status": "affected", "version": "<= 18.2.14"}]}], "references": [{"url": "https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv", "name": "https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/angular/angular/pull/67183", "name": "https://github.com/angular/angular/pull/67183", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d", "name": "https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232", "name": "https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93", "name": "https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:03:43.811Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27970", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:47:38.387Z", "dateReserved": "2026-02-25T03:24:57.793Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T02:03:43.811Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "angular", "vendor": "angular", "versions": [{"status": "affected", "version": ">= 21.2.0-next.0, < 21.2.0"}, {"status": "affected", "version": ">= 21.0.0-next.0, < 21.1.6"}, {"status": "affected", "version": ">= 20.0.0-next.0, < 20.3.17"}, {"status": "affected", "version": ">= 19.0.0-next.0, < 19.2.19"}, {"status": "affected", "version": "<= 18.2.14"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/volsync-operator-bundle", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "unaffected", "packageName": "rhacm2/volsync-rhel9", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "ceph", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "gjs", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "intel-cmt-cat", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "dotnet5.0-build-reference-packages", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "intel-cmt-cat", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "mozjs60", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ceph", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "gjs", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "intel-cmt-cat", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "polkit", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "io.apicurio-apicurito", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "io.syndesis-syndesis-parent", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-kf-notebook-controller-rhel8", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-notebook-controller-rhel8", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F31C6FF7-F094-4AA9-B370-584B3E38677A", "versionEndExcluding": "19.2.19", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1041B5A8-1BDA-46DD-9D1A-AD34856FC36F", "versionEndExcluding": "20.3.17", "versionStartIncluding": "20.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "66E854B9-DE6B-4A38-8CED-098738AF7AF1", "versionEndExcluding": "21.1.6", "versionStartIncluding": "21.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next0:*:*:*:node.js:*:*", "matchCriteriaId": "3E704C1A-A984-4809-B67D-50982182527A", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next1:*:*:*:node.js:*:*", "matchCriteriaId": "2175852C-07A5-4A07-B632-3BDE8312D3CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next2:*:*:*:node.js:*:*", "matchCriteriaId": "E9E0E76F-101F-44E4-AEC0-948593438B44", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:next3:*:*:*:node.js:*:*", "matchCriteriaId": "2521B32B-A211-4570-98FB-FAEE33551018", "vulnerable": true}, {"criteria": "cpe:2.3:a:angular:angular:21.2.0:rc0:*:*:*:node.js:*:*", "matchCriteriaId": "07CCF64D-3102-4253-8A52-58CC3EA04DEE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization."}, {"lang": "es", "value": "Angular es una plataforma de desarrollo para construir aplicaciones web m\u00f3viles y de escritorio usando TypeScript/JavaScript y otros lenguajes. Versiones anteriores a 21.2.0, 21.1.16, 20.3.17 y 19.2.19 tienen una vulnerabilidad de cross-site scripting en la tuber\u00eda de internacionalizaci\u00f3n (i18n) de Angular. En los mensajes ICU (International Components for Unicode), el HTML del contenido traducido no se sanitizaba correctamente y pod\u00eda ejecutar JavaScript arbitrario. La i18n de Angular t\u00edpicamente involucra tres pasos: extraer todos los mensajes de una aplicaci\u00f3n en el lenguaje fuente, enviar los mensajes para ser traducidos y luego fusionar sus traducciones de vuelta al c\u00f3digo fuente final. Las traducciones son frecuentemente manejadas por contratos con compa\u00f1\u00edas asociadas espec\u00edficas, e involucran el env\u00edo de los mensajes fuente a un contratista separado antes de recibir las traducciones finales para su visualizaci\u00f3n al usuario final. Si las traducciones devueltas tienen contenido malicioso, este podr\u00eda ser renderizado en la aplicaci\u00f3n y ejecutar JavaScript arbitrario. Cuando se explota con \u00e9xito, esta vulnerabilidad permite la ejecuci\u00f3n de JavaScript controlado por el atacante en el origen de la aplicaci\u00f3n. Dependiendo de la naturaleza de la aplicaci\u00f3n explotada, esto podr\u00eda llevar a la exfiltraci\u00f3n de credenciales y/o vandalismo de p\u00e1gina. Varias precondiciones se aplican al ataque. El atacante debe comprometer el archivo de traducci\u00f3n (xliff, xtb, etc.). A diferencia de la mayor\u00eda de las vulnerabilidades XSS, este problema no es explotable por usuarios arbitrarios. Un atacante debe primero comprometer el archivo de traducci\u00f3n de una aplicaci\u00f3n antes de que pueda escalar privilegios en el cliente de la aplicaci\u00f3n Angular. La aplicaci\u00f3n v\u00edctima debe usar Angular i18n, usar uno o m\u00e1s mensajes ICU, renderizar un mensaje ICU y no defenderse contra XSS a trav\u00e9s de una pol\u00edtica de seguridad de contenido segura. Las versiones 21.2.0, 21.1.6, 20.3.17 y 19.2.19 parchean el problema. Hasta que se aplique el parche, los desarrolladores deber\u00edan considerar revisar y verificar el contenido traducido recibido de terceros no confiables antes de incorporarlo en una aplicaci\u00f3n Angular, habilitar controles CSP estrictos para bloquear la ejecuci\u00f3n de JavaScript no autorizado en la p\u00e1gina y habilitar Trusted Types para forzar una sanitizaci\u00f3n HTML adecuada."}], "id": "CVE-2026-27970", "lastModified": "2026-07-15T02:19:13.267", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.5, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27970", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T14:47:13.378204Z", "version": "2.0.3"}}]}, "published": "2026-02-26T02:16:24.353", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/angular/angular/pull/67183"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-27970"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442934"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27970.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "@angular/core: Angular: Cross-site scripting via compromised translation files", "id": "2442934", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442934"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-79", "details": ["Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-27970", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/volsync-operator-bundle", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "intel-cmt-cat", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet5.0-build-reference-packages", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "intel-cmt-cat", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mozjs60", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "intel-cmt-cat", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "polkit", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Will not fix", "package_name": "io.apicurio-apicurito", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Will not fix", "package_name": "io.syndesis-syndesis-parent", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-kf-notebook-controller-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-notebook-controller-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-02-26T02:03:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27970\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27970\nhttps://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d\nhttps://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232\nhttps://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93\nhttps://github.com/angular/angular/pull/67183\nhttps://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.2.0-next.0,21.2.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0-next.0,21.1.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0-next.0,20.3.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.0.0-next.0,19.2.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,18.2.14]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "angular", "source": "cna", "vendor": "angular"}, "product": "angular", "vendor": "angular"}], "analysis": {"en": {"generated_at": "2026-04-18T17:36:09.613172+00:00", "value": {"mitigation_remediation": ["Upgrade to Angular 21.2.0 or later, 21.1.6 or later, 20.3.17 or later, or 19.2.19 or later, applying the security fix that sanitizes ICU messages.", "Perform a thorough audit of all translation files supplied by third\u2011party partners, ensuring that any inserted HTML is sanitized or stripped before integration, and reject any files containing raw script tags.", "Enable a Content Security Policy that blocks inline JavaScript and restricts script sources to trusted origins, thereby mitigating accidental execution of injected code.", "Configure Trusted Types in the application to enforce safe usage of the DOM and prevent injection of unsanitized content."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via XSS"}, "threat_synthesis": {"affected_systems": "Angular developers who still use versions older than 21.2.0, 21.1.16, 20.3.17 or 19.2.19 \u2013 including any pre\u2011release builds such as 21.2.0\u2011next0, 21.2.0\u2011next1, 21.2.0\u2011next2, 21.2.0\u2011next3 or 21.2.0\u2011rc0 \u2013 are exposed. The vulnerability is triggered only when the application uses Angular i18n with ICU messages that are parsed from an external translation file (e.g., XLIFF or XTB). Applications that do not use i18n or do not render ICU messages are not affected. Based on the description, it is inferred that the flaw is only exploitable when translation files are imported from third\u2011party sources.", "description_and_impact": "The XSS flaw, a classic example of CWE-79 (Cross\u2011Site Scripting), arises when Angular i18n processes ICU messages from external translation files. Because HTML within the translated content is not sanitized, a malicious translator can inject JavaScript that runs in the context of the application. Once executed, the script can steal credentials, modify the page or perform other client\u2011side attacks, effectively giving an attacker remote code execution within the application origin. The likely attack vector is the injection of malicious HTML into an external translation file that Angular will later parse and render.", "risk_and_exploitability": "The CVSS base score of 7.6 indicates a moderate to high severity. The EPSS score of less than 1\u202f% suggests that, while the flaw is known, the probability of exploitation in the near term is low, partly because an attacker must gain access to a translation file or supply a malicious translation. The vulnerability is not listed in the CISA KEV catalogue, and there is no indication of public exploits at this time. Nonetheless, the potential impact \u2013 arbitrary client\u2011side code execution \u2013 warrants immediate remediation. The likely attack vector involves an attacker compromising or forging a translation file that is subsequently merged into the application, allowing the injection of untrusted HTML that is rendered with user privileges."}}}}, "created": "2026-02-26T13:09:50.770405+00:00", "updated": "2026-04-18T17:45:06.055018+00:00", "vendors": ["angular", "angular$PRODUCT$angular"]}