Back to the CVE list
CVE-2026-69151

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

CVSS score

7.6

EPSS probability

%0.3

Risk score

0.0

Published

2 mo ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
A patch is available only for some products or versions

Kanıt listesindeki ürün ve sürüm eşleşmesini kontrol edin; bazı varyantlar hâlâ etkileniyor olabilir.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2026-69151 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2026-69151 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1angularangular View
2angularcompiler View
3angularcore View
4angularangular View
5angularangular View
6angularangular View
7angularangular View
8Red Hatred_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-operator-bundle View
9Red Hatred_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9 View
10Red Hatred_hat_build_of_apicurio_registry_3:apicurio/apicurio-registry-ui-rhel8 View
11Red Hatred_hat_ceph_storage_4:ceph-base View
12Red Hatred_hat_ceph_storage_4:ceph-common View
13Red Hatred_hat_ceph_storage_4:ceph-fuse View
14Red Hatred_hat_ceph_storage_4:ceph-grafana-dashboards View
15Red Hatred_hat_ceph_storage_4:ceph-mds View
16Red Hatred_hat_ceph_storage_4:ceph-mgr View
17Red Hatred_hat_ceph_storage_4:ceph-mgr-dashboard View
18Red Hatred_hat_ceph_storage_4:ceph-mgr-diskprediction-local View
19Red Hatred_hat_ceph_storage_4:ceph-mgr-k8sevents View
20Red Hatred_hat_ceph_storage_4:ceph-mgr-rook View
21Red Hatred_hat_ceph_storage_4:ceph-mon View
22Red Hatred_hat_ceph_storage_4:ceph-osd View
23Red Hatred_hat_ceph_storage_4:ceph-radosgw View
24Red Hatred_hat_ceph_storage_4:ceph-selinux View
25Red Hatred_hat_ceph_storage_4:ceph-test View
26Red Hatred_hat_ceph_storage_4:ceph.src View
27Red Hatred_hat_ceph_storage_4:libcephfs-devel View
28Red Hatred_hat_ceph_storage_4:libcephfs2 View
29Red Hatred_hat_ceph_storage_4:librados-devel View
30Red Hatred_hat_ceph_storage_4:librados2 View
31Red Hatred_hat_ceph_storage_4:libradospp-devel View
32Red Hatred_hat_ceph_storage_4:libradosstriper1 View
33Red Hatred_hat_ceph_storage_4:librbd-devel View
34Red Hatred_hat_ceph_storage_4:librbd1 View
35Red Hatred_hat_ceph_storage_4:librgw-devel View
36Red Hatred_hat_ceph_storage_4:librgw2 View
37Red Hatred_hat_ceph_storage_4:python-ceph-argparse View
38Red Hatred_hat_ceph_storage_4:python-cephfs View
39Red Hatred_hat_ceph_storage_4:python-rados View
40Red Hatred_hat_ceph_storage_4:python-rbd View
41Red Hatred_hat_ceph_storage_4:python-rgw View
42Red Hatred_hat_ceph_storage_4:python3-ceph-argparse View
43Red Hatred_hat_ceph_storage_4:python3-cephfs View
44Red Hatred_hat_ceph_storage_4:python3-rados View
45Red Hatred_hat_ceph_storage_4:python3-rbd View
46Red Hatred_hat_ceph_storage_4:python3-rgw View
47Red Hatred_hat_ceph_storage_4:rbd-mirror View
48Red Hatred_hat_ceph_storage_4:rbd-nbd View
49Red Hatred_hat_enterprise_linux_10:firefox View
50Red Hatred_hat_enterprise_linux_10:firefox.src View
51Red Hatred_hat_enterprise_linux_10:gjs-devel View
52Red Hatred_hat_enterprise_linux_10:gjs.src View
53Red Hatred_hat_enterprise_linux_10:intel-cmt-cat-devel View
54Red Hatred_hat_enterprise_linux_10:intel-cmt-cat.src View
55Red Hatred_hat_enterprise_linux_10:librados-devel View
56Red Hatred_hat_enterprise_linux_10:librados2 View
57Red Hatred_hat_enterprise_linux_10:libradospp-devel View
58Red Hatred_hat_enterprise_linux_10:librbd-devel View
59Red Hatred_hat_enterprise_linux_10:librbd1 View
60Red Hatred_hat_enterprise_linux_10:thunderbird View
61Red Hatred_hat_enterprise_linux_10:thunderbird.src View
62Red Hatred_hat_enterprise_linux_7:firefox View
63Red Hatred_hat_enterprise_linux_7:firefox.src View
64Red Hatred_hat_enterprise_linux_8:dotnet5.0-build-reference-packages.src View
65Red Hatred_hat_enterprise_linux_8:firefox View
66Red Hatred_hat_enterprise_linux_8:firefox.src View
67Red Hatred_hat_enterprise_linux_8:intel-cmt-cat-devel View
68Red Hatred_hat_enterprise_linux_8:intel-cmt-cat.src View
69Red Hatred_hat_enterprise_linux_8:mozjs60 View
70Red Hatred_hat_enterprise_linux_8:mozjs60-devel View
71Red Hatred_hat_enterprise_linux_8:mozjs60.src View
72Red Hatred_hat_enterprise_linux_8:thunderbird View
73Red Hatred_hat_enterprise_linux_8:thunderbird.src View
74Red Hatred_hat_enterprise_linux_9:firefox View
75Red Hatred_hat_enterprise_linux_9:firefox-x11 View
76Red Hatred_hat_enterprise_linux_9:firefox.src View
77Red Hatred_hat_enterprise_linux_9:gjs-devel View
78Red Hatred_hat_enterprise_linux_9:gjs.src View
79Red Hatred_hat_enterprise_linux_9:intel-cmt-cat-devel View
80Red Hatred_hat_enterprise_linux_9:intel-cmt-cat.src View
81Red Hatred_hat_enterprise_linux_9:librados-devel View
82Red Hatred_hat_enterprise_linux_9:librados2 View
83Red Hatred_hat_enterprise_linux_9:libradospp-devel View
84Red Hatred_hat_enterprise_linux_9:librbd-devel View
85Red Hatred_hat_enterprise_linux_9:librbd1 View
86Red Hatred_hat_enterprise_linux_9:thunderbird View
87Red Hatred_hat_enterprise_linux_9:thunderbird.src View
88npm@angular/compiler View
89npm@angular/compiler View
90npm@angular/compiler View
91npm@angular/compiler View
92npm@angular/core View
93npm@angular/core View
94npm@angular/core View
95npm@angular/core View
96npm@angular/compiler View
97npm@angular/compiler View
98npm@angular/compiler View
99npm@angular/compiler View
100npm@angular/core View
101npm@angular/core View
102npm@angular/core View
103npm@angular/core View
Total affected vendors: 3|Products: 103

RED HAT CSAF/VEX: Product Impact Check

Does this CVE affect my Red Hat product?

The results come directly from the Red Hat CSAF VEX product status; they are not estimates.

Affected

Red Hat bu ürün sürümünü etkilenen olarak işaretliyor.

Red Hat fixes

Affected

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.1cvss_v3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NRed Hat
7.6CVSS 4.0—Vector not publishedGitHub Advisory
7.6CVSS V40HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
7.6CVSS V4_0HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE CNA
6.1CVSS V31MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Partial patch

8 düzeltme kanıtı bulundu; en az 80 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.

redhat

Affected

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
osv@angular/compiler22.0.1

OSV düzeltilmiş sürüm: 22.0.1

osv@angular/compiler21.2.19

OSV düzeltilmiş sürüm: 21.2.19

osv@angular/compiler20.3.27

OSV düzeltilmiş sürüm: 20.3.27

osv@angular/core22.0.1

OSV düzeltilmiş sürüm: 22.0.1

osv@angular/core21.2.19

OSV düzeltilmiş sürüm: 21.2.19

osv@angular/core20.3.27

OSV düzeltilmiş sürüm: 20.3.27

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-69151 is associated with the following CWEs:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-69151 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
User—

Official Sources and Advisories

https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99vendor-advisoryhttps://github.com/angular/angular/pull/68821vendor-advisoryhttps://github.com/angular/angular/pull/69306vendor-advisoryhttps://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5evendor-advisoryhttps://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865vendor-advisoryCanonical URLvendor-advisoryRHBZ#2510726vendor-advisoryhttps://www.cve.org/CVERecord?id=CVE-2026-69151vendor-advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-69151vendor-advisoryhttps://github.com/advisories/GHSA-jj27-h5hq-8x99vendor-advisory

CVSS Vector Radar Chart

7.6 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.RequiredConfidentialityLowIntegrityNoneAvailabilityNone

Vulnerability Scoring Details

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User InteractionP
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)P
Availability (Erişilebilirlik)None

Kısmi yama

8 düzeltme kanıtı bulundu; en az 80 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.

Follow the vendor

A
angular logo
angular
RH
Red Hat logo
Red Hat
N
npm logo
npm

Weakness Type (CWE & CAPEC)

CWE-79

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-69151"