9

CVE-2026-32635: angular angular_cli Cross-site Scripting

CVSS: 9.0v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-32635DEBIAN-CVE-2026-32635GHSA-g93w-mfhg-p222
Published 13-03-2026Last modified 17-03-2026
Open JSON

Vulnerability summary

CVE-2026-32635 is a critical (CVSS 9.0) Cross-site Scripting vulnerability in angular angular_cli. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.6% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.0/10
010
Critical · v3.1 (NVD)
EPSS score
0.50%
0%100%
Low · +0.16 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-03-2026
    PublishedVulnerability first disclosed.
  2. 17-03-2026
    Last modifiedVulnerability information updated.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

CVSS metrics

8 scores · 5 sources · 2 versions

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

+0.16 pp

From 0.34% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

@angular4 products
  • compiler≥ 22.0.0-next.0, < 22.0.0-next.3 | ≥ 21.0.0-next.0, < 21.2.4 | ≥ 20.0.0-next.0, < 20.3.18 | ≥ 17.0.0.next.0, < 19.2.20
  • core≥ 22.0.0-next.0, < 22.0.0-next.3 | ≥ 21.0.0-next.0, < 21.2.4 | ≥ 20.0.0-next.0, < 20.3.18 | ≥ 17.0.0.next.0, < 19.2.20
  • compiler≥ 22.0.0-next.0, < 22.0.0-next.3 | ≥ 21.0.0-next.0, < 21.2.4 | ≥ 20.0.0-next.0.0.0, < 20.3.18 | ≥ 19.0.0-next.0, < 19.2.20 | ≥ 17.0.0-next.0, ≤ 18.2.14
  • core≥ 22.0.0-next.0, < 22.0.0-next.3 | ≥ 21.0.0-next.0, < 21.2.4 | ≥ 20.0.0-next.0.0.0, < 20.3.18 | ≥ 19.0.0-next.0, < 19.2.20 | ≥ 17.0.0-next.0, ≤ 18.2.14
Angular1 product
  • angular_cli≥ 17.0.0, < 19.2.0 | ≥ 20.0.0, ≤ 20.3.18 | ≥ 21.0.0, < 21.2.4 | 22.0.0:next0 | 22.0.0:next1
Debian1 product
  • angular.jsAll versions (No fix recorded)
Ubuntu1 product
  • angular.jsAll versions (No fix recorded)

4 vendors · 7 products

References

12 links
Show all 12 references