Cross-Site Scripting (XSS)

🗓️ 20 Jun 2026 05:48:05Reported by Veracode Vulnerability DatabaseType

Angular XSS occurs when the compiler fails to sanitize two-way bound native properties, enabling script injection.

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certifcate Manager	29 Jun 202614:12	–	ibm
ATTACKERKB	CVE-2026-54265	22 Jun 202615:27	–	attackerkb
CVE	CVE-2026-54265	22 Jun 202615:27	–	cve
Cvelist	CVE-2026-54265 Angular: Two-Way Property Binding Sanitization Bypass (XSS)	22 Jun 202615:27	–	cvelist
Debian CVE	CVE-2026-54265	22 Jun 202615:27	–	debiancve
EUVD	EUVD-2026-38268	22 Jun 202615:27	–	euvd
Github Security Blog	@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)	15 Jun 202617:22	–	github
NVD	CVE-2026-54265	22 Jun 202616:16	–	nvd
OSV	DEBIAN-CVE-2026-54265	22 Jun 202616:16	–	osv
OSV	GHSA-58W9-8G37-X9V5 @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)	15 Jun 202617:22	–	osv

Vulners

Node

adobe @angular/compilerRange22.0.0-next.0–22.0.0js

adobe @angular/compilerRange21.0.0-next.0–21.2.16js

adobe @angular/compilerRange20.0.0-next.0–20.3.24js

adobe @angular/compilerRange0.0.0-0–19.2.25js

Source	Link
github	www.github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918
github	www.github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4
github	www.github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4
github	www.github.com/angular/angular/commit/a68ec702a056a2706a152fce29081241fd276f12
github	www.github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4
github	www.github.com/angular/angular/pull/69107
github	www.github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5

01 Jul 2026 19:21Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.1

CVSS 45.3

EPSS0.00195

SSVC