CVE-2026-50557

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

Medium5.3EPSS 0.41%

Published: 22 Jun 2026
Updated: 22 Jun 2026
Reserved: 4 Jun 2026
Assigned by: GitHub_M

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22.

Scores

CVSS scores of CVE-2026-50557, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.41% · top 64% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

angular · angular
- affected >= 21.0.0-next.0 < 21.2.15
- affected >= 22.0.0-next.0 < 22.0.0-rc.2
- affected >= 20.0.0-next.0 < 20.3.22
- affected >= 19.0.0-next.0 < 19.2.22
- affected <= 18.2.14

Affected packages

From reviewed advisories of the GitHub Advisory Database.

npm@angular/compilerGHSA-f3m7-gqxr-g87x (opens in a new tab)
npm@angular/coreGHSA-f3m7-gqxr-g87x (opens in a new tab)

References (3)

https://github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x (opens in a new tab)x_refsource_CONFIRM
https://github.com/angular/angular/pull/68689 (opens in a new tab)x_refsource_MISC
https://github.com/angular/angular/pull/68868 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-50557](https://trackcve.app/badge/CVE-2026-50557.svg)](https://trackcve.app/cve/CVE-2026-50557)

Record last updated 22 Jun 2026, 17:54 UTC.