CVE-2026-22610

🗓️ 10 Jan 2026 03:35:40Reported by Debian Security Bug TrackerType

Angular Template Compiler XSS in SVG script href and xlink:href not treated as Resource URL; fixed in 19.2.18, 20.3.16, 21.0.7, 21.1.0-rc.0.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities related to Angular and JJWT have been fixed in IBM Informix HQ 3.2.2.	27 Apr 202606:31	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of compiler-18.2.14.tgz, IBM Sterling Connect:Direct Web Services is affected by Cross-Site Scripting (XSS).	2 Jun 202614:44	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of core-18.2.14.tgz, IBM Sterling Connect:Direct Web Services is affected by cross-site scripting (XSS) issue.	2 Jun 202614:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting and cross-site request forgery due to Angular [CVE-2025-66412, CVE-2026-22610, CVE-2025-66035]	20 Feb 202616:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is affected by Cross-Site Request Forgery and Cross-Site Scripting in Digital Certificate Manager and Navigator for i [CVE-2025-66035, CVE-2025-66412, CVE-2026-22610]	20 Feb 202616:42	–	ibm
GithubExploit	Exploit for CVE-2026-22610	18 Jan 202611:38	–	githubexploit
Chainguard	CVE-2026-22610 vulnerabilities	15 Jul 202614:17	–	cgr
Circl	CVE-2026-22610	10 Jan 202605:03	–	circl
CNNVD	Angular 跨站脚本漏洞	10 Jan 202600:00	–	cnnvd
CVE	CVE-2026-22610	10 Jan 202603:35	–	cve

OS	OS Version	Architecture	Package	Filename
Debian	11	any	angular.js	angular.js_0_any.deb
Debian	12	any	angular.js	angular.js_0_any.deb
Debian	13	any	angular.js	angular.js_0_any.deb
Debian	14	any	angular.js	angular.js_0_any.deb
Debian	999	any	angular.js	angular.js_0_any.deb

10 Jan 2026 03:35Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.16.1

CVSS 48.5

EPSS0.00444

SSVC