Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

🗓️ 09 Jan 2026 18:52:14Reported by GitHub Advisory DatabaseType

Angular XSS in SVG scripts from unsanitized href and xlink:href attributes enabling arbitrary JavaScript execution.

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)	1 Aug 202603:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities related to Angular and JJWT have been fixed in IBM Informix HQ 3.2.2.	27 Apr 202606:31	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of compiler-18.2.14.tgz, IBM Sterling Connect:Direct Web Services is affected by Cross-Site Scripting (XSS).	2 Jun 202614:44	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of core-18.2.14.tgz, IBM Sterling Connect:Direct Web Services is affected by cross-site scripting (XSS) issue.	2 Jun 202614:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)	31 Jul 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting and cross-site request forgery due to Angular [CVE-2025-66412, CVE-2026-22610, CVE-2025-66035]	20 Feb 202616:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is affected by Cross-Site Request Forgery and Cross-Site Scripting in Digital Certificate Manager and Navigator for i [CVE-2025-66035, CVE-2025-66412, CVE-2026-22610]	20 Feb 202616:42	–	ibm
GithubExploit	Exploit for CVE-2026-22610	18 Jan 202611:38	–	githubexploit
Chainguard	CVE-2026-22610 vulnerabilities	15 Jul 202614:17	–	cgr
Circl	CVE-2026-22610	10 Jan 202605:03	–	circl

Vulners

Node

angular coreRange≤18.2.14npm

angular compilerRange≤18.2.14npm

angular coreRange19.0.0-next.0–19.2.18npm

angular compilerRange19.0.0-next.0–19.2.18npm

angular coreRange20.0.0-next.0–20.3.16npm

angular compilerRange20.0.0-next.0–20.3.16npm

angular coreRange21.0.0-next.0–21.0.7npm

angular compilerRange21.0.0-next.0–21.0.7npm

angular coreRange21.1.0-next.0–21.1.0-rc.0npm

angular compilerRange21.1.0-next.0–21.1.0-rc.0npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6
github	www.github.com/angular/angular/pull/66318
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-22610
github	www.github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-253495.html
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-485750.html
github	www.github.com/advisories/GHSA-jrmj-c5cx-3cw6

09 Jun 2026 10:56Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.1

CVSS 48.5

EPSS0.00444

SSVC

CWE-79