Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

🗓️ 15 Jun 2026 17:21:58Reported by GitHub Advisory DatabaseType

Namespaced script elements and attributes bypass Angular sanitizers, enabling XSS in runtime templates.

Reporter	Title	Published	Views	Family All 3
CVE	CVE-2026-50557	15 Jun 202617:21	–	cve
OSV	GHSA-F3M7-GQXR-G87X Angular: Template and Attribute Namespace Sanitization Bypass (XSS)	15 Jun 202617:21	–	osv
Positive Technologies	PT-2026-49567	15 Jun 202600:00	–	ptsecurity

Vulners

Node

angular compilerRange≤18.2.14npm

angular compilerRange19.0.0-next.0–19.2.22npm

angular compilerRange20.0.0-next.0–20.3.22npm

angular compilerRange22.0.0-next.0–22.0.0-rc.2npm

angular compilerRange21.0.0-next.0–21.2.15npm

angular coreRange≤18.2.14npm

angular coreRange19.0.0-next.0–19.2.22npm

angular coreRange20.0.0-next.0–20.3.22npm

angular coreRange22.0.0-next.0–22.0.0-rc.2npm

angular coreRange21.0.0-next.0–21.2.15npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x
github	www.github.com/angular/angular/pull/68689
github	www.github.com/angular/angular/pull/68868
github	www.github.com/advisories/GHSA-f3m7-gqxr-g87x

15 Jun 2026 17:22Current

5.9Medium risk

Vulners AI Score5.9

EPSS0.00071