High severityNVD Advisory· Published Feb 26, 2026· Updated Feb 26, 2026

Angular i18n vulnerable to Cross-Site Scripting (XSS)

CVE-2026-27970

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@angular/corenpm	>= 21.2.0-next.0, < 21.2.0	21.2.0
@angular/corenpm	>= 21.0.0-next.0, < 21.1.6	21.1.6
@angular/corenpm	>= 20.0.0-next.0, < 20.3.17	20.3.17
@angular/corenpm	>= 19.0.0-next.0, < 19.2.19	19.2.19
@angular/corenpm	<= 18.2.14	—

Affected products

Angular/Angularv5
Range: >= 21.2.0-next.0, < 21.2.0

Patches

b85830953281

fix(core): block creation of sensitive URI attributes from ICU messages

https://github.com/angular/angularDoug ParkerFeb 13, 2026via ghsa

commit

3 files changed · +75 −10

packages/core/src/render3/i18n/i18n_parse.ts+29 −8 modified

@@ -808,7 +808,6 @@ function walkIcuTree(
             const attr = elAttrs.item(i)!;
             const lowerAttrName = attr.name.toLowerCase();
             const hasBinding = !!attr.value.match(BINDING_REGEXP);
-            // we assume the input string is safe, unless it's using a binding
             if (hasBinding) {
               if (VALID_ATTRS.hasOwnProperty(lowerAttrName)) {
                 if (URI_ATTRS[lowerAttrName]) {
@@ -831,8 +830,29 @@ function walkIcuTree(
                       `(see ${XSS_SECURITY_URL})`,
                   );
               }
+            } else if (VALID_ATTRS[lowerAttrName]) {
+              if (URI_ATTRS[lowerAttrName]) {
+                // Don't sanitize, because no value is acceptable in sensitive attributes.
+                // Translators are not allowed to create URIs.
+                if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                  console.warn(
+                    `WARNING: ignoring unsafe attribute ` +
+                      `${lowerAttrName} on element ${tagName} ` +
+                      `(see ${XSS_SECURITY_URL})`,
+                  );
+                }
+                addCreateAttribute(create, newIndex, attr.name, 'unsafe:blocked');
+              } else {
+                addCreateAttribute(create, newIndex, attr.name, attr.value);
+              }
             } else {
-              addCreateAttribute(create, newIndex, attr);
+              if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                console.warn(
+                  `WARNING: ignoring unknown attribute name ` +
+                    `${lowerAttrName} on element ${tagName} ` +
+                    `(see ${XSS_SECURITY_URL})`,
+                );
+              }
             }
           }
           const elementNode: I18nElementNode = {
@@ -945,10 +965,11 @@ function addCreateNodeAndAppend(
   );
 }
 
-function addCreateAttribute(create: IcuCreateOpCodes, newIndex: number, attr: Attr) {
-  create.push(
-    (newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr,
-    attr.name,
-    attr.value,
-  );
+function addCreateAttribute(
+  create: IcuCreateOpCodes,
+  newIndex: number,
+  attrName: string,
+  attrValue: string,
+) {
+  create.push((newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr, attrName, attrValue);
 }

packages/core/test/acceptance/i18n_spec.ts+2 −2 modified

@@ -3434,7 +3434,7 @@ describe('runtime i18n', () => {
           {parameters.length, plural,
             =1 {
               Affects parameter
-              <span class="parameter-name" attr="should_be_present">{{ parameters[0].name }}</span>
+              <span class="parameter-name" label="should_be_present">{{ parameters[0].name }}</span>
             }
             other {
               Affects {{parameters.length}} parameters, including
@@ -3453,7 +3453,7 @@ describe('runtime i18n', () => {
     const fixture = TestBed.createComponent(MyApp);
     fixture.detectChanges();
     const span = (fixture.nativeElement as HTMLElement).querySelector('span')!;
-    expect(span.getAttribute('attr')).toEqual('should_be_present');
+    expect(span.getAttribute('label')).toEqual('should_be_present');
     expect(span.getAttribute('class')).toEqual('parameter-name');
   });

packages/core/test/render3/i18n/i18n_parse_spec.ts+44 −0 modified

@@ -297,6 +297,50 @@ describe('i18n_parse', () => {
         );
       });
     });
+
+    it('should properly sanitize malicious URLs like `<a href="evil.test">` injected into translations', () => {
+      const tI18n = toT18n(`{
+        �0�, select,
+          A {<a href="javascript:console.log('hacked!');">malicious JS</a>}
+          other {<a href="https://evil.test">malicious link</a>}
+      }`);
+
+      fixture.apply(() => {
+        applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
+        expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('A');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(
+          `<a href="unsafe:blocked">malicious JS</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
+        );
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('other');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(
+          `<a href="unsafe:blocked">malicious link</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
+        );
+      });
+    });
+
+    it('should ignore unknown attributes', () => {
+      const tI18n = toT18n(`{�0�, select, A {<div unknown="unknown"></div>} }`);
+
+      fixture.apply(() => {
+        applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
+        expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('A');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(`<div></div><!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+    });
   });
 
   function toT18n(text: string) {

306f367899df

fix(core): block creation of sensitive URI attributes from ICU messages

https://github.com/angular/angularDoug ParkerFeb 13, 2026via ghsa

commit

3 files changed · +75 −10

packages/core/src/render3/i18n/i18n_parse.ts+29 −8 modified

@@ -808,7 +808,6 @@ function walkIcuTree(
             const attr = elAttrs.item(i)!;
             const lowerAttrName = attr.name.toLowerCase();
             const hasBinding = !!attr.value.match(BINDING_REGEXP);
-            // we assume the input string is safe, unless it's using a binding
             if (hasBinding) {
               if (VALID_ATTRS.hasOwnProperty(lowerAttrName)) {
                 if (URI_ATTRS[lowerAttrName]) {
@@ -831,8 +830,29 @@ function walkIcuTree(
                       `(see ${XSS_SECURITY_URL})`,
                   );
               }
+            } else if (VALID_ATTRS[lowerAttrName]) {
+              if (URI_ATTRS[lowerAttrName]) {
+                // Don't sanitize, because no value is acceptable in sensitive attributes.
+                // Translators are not allowed to create URIs.
+                if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                  console.warn(
+                    `WARNING: ignoring unsafe attribute ` +
+                      `${lowerAttrName} on element ${tagName} ` +
+                      `(see ${XSS_SECURITY_URL})`,
+                  );
+                }
+                addCreateAttribute(create, newIndex, attr.name, 'unsafe:blocked');
+              } else {
+                addCreateAttribute(create, newIndex, attr.name, attr.value);
+              }
             } else {
-              addCreateAttribute(create, newIndex, attr);
+              if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                console.warn(
+                  `WARNING: ignoring unknown attribute name ` +
+                    `${lowerAttrName} on element ${tagName} ` +
+                    `(see ${XSS_SECURITY_URL})`,
+                );
+              }
             }
           }
           const elementNode: I18nElementNode = {
@@ -945,10 +965,11 @@ function addCreateNodeAndAppend(
   );
 }
 
-function addCreateAttribute(create: IcuCreateOpCodes, newIndex: number, attr: Attr) {
-  create.push(
-    (newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr,
-    attr.name,
-    attr.value,
-  );
+function addCreateAttribute(
+  create: IcuCreateOpCodes,
+  newIndex: number,
+  attrName: string,
+  attrValue: string,
+) {
+  create.push((newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr, attrName, attrValue);
 }

packages/core/test/acceptance/i18n_spec.ts+2 −2 modified

@@ -3434,7 +3434,7 @@ describe('runtime i18n', () => {
           {parameters.length, plural,
             =1 {
               Affects parameter
-              <span class="parameter-name" attr="should_be_present">{{ parameters[0].name }}</span>
+              <span class="parameter-name" label="should_be_present">{{ parameters[0].name }}</span>
             }
             other {
               Affects {{parameters.length}} parameters, including
@@ -3453,7 +3453,7 @@ describe('runtime i18n', () => {
     const fixture = TestBed.createComponent(MyApp);
     fixture.detectChanges();
     const span = (fixture.nativeElement as HTMLElement).querySelector('span')!;
-    expect(span.getAttribute('attr')).toEqual('should_be_present');
+    expect(span.getAttribute('label')).toEqual('should_be_present');
     expect(span.getAttribute('class')).toEqual('parameter-name');
   });

packages/core/test/render3/i18n/i18n_parse_spec.ts+44 −0 modified

@@ -297,6 +297,50 @@ describe('i18n_parse', () => {
         );
       });
     });
+
+    it('should properly sanitize malicious URLs like `<a href="evil.test">` injected into translations', () => {
+      const tI18n = toT18n(`{
+        �0�, select,
+          A {<a href="javascript:console.log('hacked!');">malicious JS</a>}
+          other {<a href="https://evil.test">malicious link</a>}
+      }`);
+
+      fixture.apply(() => {
+        applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
+        expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('A');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(
+          `<a href="unsafe:blocked">malicious JS</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
+        );
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('other');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(
+          `<a href="unsafe:blocked">malicious link</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
+        );
+      });
+    });
+
+    it('should ignore unknown attributes', () => {
+      const tI18n = toT18n(`{�0�, select, A {<div unknown="unknown"></div>} }`);
+
+      fixture.apply(() => {
+        applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
+        expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('A');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(`<div></div><!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+    });
   });
 
   function toT18n(text: string) {

7d58b798c626

fix(core): block creation of sensitive URI attributes from ICU messages

https://github.com/angular/angularDoug ParkerFeb 13, 2026via ghsa

commit

3 files changed · +75 −10

packages/core/src/render3/i18n/i18n_parse.ts+29 −8 modified

@@ -808,7 +808,6 @@ function walkIcuTree(
             const attr = elAttrs.item(i)!;
             const lowerAttrName = attr.name.toLowerCase();
             const hasBinding = !!attr.value.match(BINDING_REGEXP);
-            // we assume the input string is safe, unless it's using a binding
             if (hasBinding) {
               if (VALID_ATTRS.hasOwnProperty(lowerAttrName)) {
                 if (URI_ATTRS[lowerAttrName]) {
@@ -831,8 +830,29 @@ function walkIcuTree(
                       `(see ${XSS_SECURITY_URL})`,
                   );
               }
+            } else if (VALID_ATTRS[lowerAttrName]) {
+              if (URI_ATTRS[lowerAttrName]) {
+                // Don't sanitize, because no value is acceptable in sensitive attributes.
+                // Translators are not allowed to create URIs.
+                if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                  console.warn(
+                    `WARNING: ignoring unsafe attribute ` +
+                      `${lowerAttrName} on element ${tagName} ` +
+                      `(see ${XSS_SECURITY_URL})`,
+                  );
+                }
+                addCreateAttribute(create, newIndex, attr.name, 'unsafe:blocked');
+              } else {
+                addCreateAttribute(create, newIndex, attr.name, attr.value);
+              }
             } else {
-              addCreateAttribute(create, newIndex, attr);
+              if (typeof ngDevMode !== 'undefined' && ngDevMode) {
+                console.warn(
+                  `WARNING: ignoring unknown attribute name ` +
+                    `${lowerAttrName} on element ${tagName} ` +
+                    `(see ${XSS_SECURITY_URL})`,
+                );
+              }
             }
           }
           const elementNode: I18nElementNode = {
@@ -945,10 +965,11 @@ function addCreateNodeAndAppend(
   );
 }
 
-function addCreateAttribute(create: IcuCreateOpCodes, newIndex: number, attr: Attr) {
-  create.push(
-    (newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr,
-    attr.name,
-    attr.value,
-  );
+function addCreateAttribute(
+  create: IcuCreateOpCodes,
+  newIndex: number,
+  attrName: string,
+  attrValue: string,
+) {
+  create.push((newIndex << IcuCreateOpCode.SHIFT_REF) | IcuCreateOpCode.Attr, attrName, attrValue);
 }

packages/core/test/acceptance/i18n_spec.ts+2 −2 modified

@@ -3434,7 +3434,7 @@ describe('runtime i18n', () => {
           {parameters.length, plural,
             =1 {
               Affects parameter
-              <span class="parameter-name" attr="should_be_present">{{ parameters[0].name }}</span>
+              <span class="parameter-name" label="should_be_present">{{ parameters[0].name }}</span>
             }
             other {
               Affects {{parameters.length}} parameters, including
@@ -3453,7 +3453,7 @@ describe('runtime i18n', () => {
     const fixture = TestBed.createComponent(MyApp);
     fixture.detectChanges();
     const span = (fixture.nativeElement as HTMLElement).querySelector('span')!;
-    expect(span.getAttribute('attr')).toEqual('should_be_present');
+    expect(span.getAttribute('label')).toEqual('should_be_present');
     expect(span.getAttribute('class')).toEqual('parameter-name');
   });

packages/core/test/render3/i18n/i18n_parse_spec.ts+44 −0 modified

@@ -297,6 +297,50 @@ describe('i18n_parse', () => {
         );
       });
     });
+
+    it('should properly sanitize malicious URLs like `<a href="evil.test">` injected into translations', () => {
+      const tI18n = toT18n(`{
+        �0�, select,
+          A {<a href="javascript:console.log('hacked!');">malicious JS</a>}
+          other {<a href="https://evil.test">malicious link</a>}
+      }`);
+
+      fixture.apply(() => {
+        applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
+        expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('A');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(
+          `<a href="unsafe:blocked">malicious JS</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
+        );
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('other');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(
+          `<a href="unsafe:blocked">malicious link</a><!--ICU ${HEADER_OFFSET + 0}:0-->`,
+        );
+      });
+    });
+
+    it('should ignore unknown attributes', () => {
+      const tI18n = toT18n(`{�0�, select, A {<div unknown="unknown"></div>} }`);
+
+      fixture.apply(() => {
+        applyCreateOpCodes(fixture.lView, tI18n.create, fixture.host, null);
+        expect(fixture.host.innerHTML).toEqual(`<!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+
+      fixture.apply(() => {
+        ɵɵi18nExp('A');
+        ɵɵi18nApply(0);
+        expect(fixture.host.innerHTML).toEqual(`<div></div><!--ICU ${HEADER_OFFSET + 0}:0-->`);
+      });
+    });
   });
 
   function toT18n(text: string) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/advisories/GHSA-prjf-86w9-mfqvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-27970ghsaADVISORY
angular.dev/best-practices/securityghsaWEB
developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_APIghsaWEB
developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSPghsaWEB
developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSSghsaWEB
github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075dghsax_refsource_MISCWEB
github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232ghsax_refsource_MISCWEB
github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93ghsax_refsource_MISCWEB
github.com/angular/angular/pull/67183ghsax_refsource_MISCWEB
github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqvghsax_refsource_CONFIRMWEB

News mentions

Google Fixes Critical RCE Flaw in AI-Based 'Antigravity' Tool
Dark Reading · Apr 21, 2026

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000