@agdo/object-model (>=1.0.1, <=1.2.34), @agilie/widget-template (>=1.0.2, <=1.1.6) +415 more potentially affected by CVE-2026-27970 via @angular/core (>=18.0.0, <=18.2.14)

@angular/core NPM version =18.0.0, =1.0.1, =1.0.2, =0.0.0, =1.0.0, =0.0.55, =1.0.0, =18.2.0, =7.0.0, =7.0.3 - @auscope/angular2parse 18.0.0 and more Source cves: CVE-2026-27970 Source advisory: OSV:GHSA-PRJF-86W9-MFQV...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +37 more potentially affected by CVE-2026-27970 via @angular/core (>=20.0.0, <=20.3.16)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =9.0.0 and more Source cves: CVE-2026-27970 Source advisory: OSV:GHSA-PRJF-86W9-MFQV...

EUVD-2026-8822

Angular i18n vulnerable to Cross-Site Scripting...

Angular i18n vulnerable to Cross-Site Scripting

A Cross-site Scripting XSS vulnerability has been identified in the Angular internationalization i18n pipeline. In ICU messages International Components for Unicode, HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves thr...

GHSA-PRJF-86W9-MFQV Angular i18n vulnerable to Cross-Site Scripting

A Cross-site Scripting XSS vulnerability has been identified in the Angular internationalization i18n pipeline. In ICU messages International Components for Unicode, HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves thr...

CVE-2026-27738

The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in versions on the 19.x branch prior to 19.2.21, the 20.x branch prior to 20.3.17, and the 21.x branch prior to 21.1.5 and 21.2.0-rc.1. The logic...

CVE-2026-27739

The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 have a Server-Side Request Forgery SSRF vulnerability in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +39 more potentially affected by CVE-2026-27970 via @angular/core (>=19.0.0, <=19.2.18)

@angular/core NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-27970 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.192-alpha) +37 more potentially affected by CVE-2026-27970 via @angular/core (>=21.0.0, <=21.1.5)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =4.0.0, =5.38.0, =4.0.0, =5.15.0, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-27970 Source advisory: SNYK:JS-ANGULARCORE-15353393...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +37 more potentially affected by CVE-2026-27970 via @angular/core (>=20.0.0, <=20.3.16)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =9.0.0 and more Source cves: CVE-2026-27970 Source advisory: SNYK:JS-ANGULARCORE-15353393...

Cross-site Scripting (XSS)

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

DEBIAN-CVE-2026-27970

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

CVE-2026-27970

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

CVE-2026-27970

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

UBUNTU-CVE-2026-27970

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

CVE-2026-27970

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

CVE-2026-27970 Angular i18n vulnerable to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

CVE-2026-27970

Angular CVE-2026-27970 affects multiple older Angular releases (e.g., 21.2.0, 21.1.16, 20.3.17, 19.2.19) with an XSS in the i18n ICU message pipeline due to inadequate sanitization of HTML from translated content. An attacker must first compromise the translation file (xliff/xtb, etc.) and then l...

CVE-2026-27970 Angular i18n vulnerable to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

CVE-2026-27970 Angular i18n vulnerable to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...