Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

🗓️ 15 Jun 2026 17:21:58Reported by GitHub Advisory DatabaseType

Namespaced script elements and attributes bypass Angular sanitizers, enabling XSS in runtime templates.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities due to Angular [CVE-2026-50170, CVE-2026-50171, CVE-2026-54266, CVE-2026-54268, CVE-2026-50557, CVE-2026-52725, CVE-2026-54267, CVE-2026-54265]	22 Jul 202605:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certifcate Manager	29 Jun 202614:12	–	ibm
ATTACKERKB	CVE-2026-50557	22 Jun 202615:11	–	attackerkb
Chainguard	CVE-2026-50557 vulnerabilities	15 Jul 202614:17	–	cgr
CVE	CVE-2026-50557	22 Jun 202615:11	–	cve
Cvelist	CVE-2026-50557 Angular: Template and Attribute Namespace Sanitization Bypass (XSS)	22 Jun 202615:11	–	cvelist
Debian CVE	CVE-2026-50557	22 Jun 202615:11	–	debiancve
EUVD	EUVD-2026-38257	22 Jun 202615:11	–	euvd
NVD	CVE-2026-50557	22 Jun 202616:16	–	nvd
OSV	CGA-CJC5-9CMC-6PGH	15 Jul 202614:38	–	osv

Vulners

Node

angular compilerRange≤18.2.14npm

angular compilerRange19.0.0-next.0–19.2.22npm

angular compilerRange20.0.0-next.0–20.3.22npm

angular compilerRange22.0.0-next.0–22.0.0-rc.2npm

angular compilerRange21.0.0-next.0–21.2.15npm

angular coreRange≤18.2.14npm

angular coreRange19.0.0-next.0–19.2.22npm

angular coreRange20.0.0-next.0–20.3.22npm

angular coreRange22.0.0-next.0–22.0.0-rc.2npm

angular coreRange21.0.0-next.0–21.2.15npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-f3m7-gqxr-g87x
github	www.github.com/angular/angular/pull/68689
github	www.github.com/angular/angular/pull/68868
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-50557
github	www.github.com/advisories/GHSA-f3m7-gqxr-g87x

15 Jul 2026 22:03Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.1

CVSS 45.3

EPSS0.00203

SSVC