By vendor

Angular vulnerabilities

Known CVEs affecting Angular products, prioritized by severity, with SEC.co remediation and detection guidance.

17 published vulnerabilities

• CVE-2026-49241HIGH 8.8

  The Angular Language Service VS Code Extension allows developers to write Angular code with advanced IDE features like autocomplete and error checking. A critical flaw in versions before 21.2.4 lets an attacker hide malicious code in a project repository that automatically executes when a developer opens that folder in VS Code. The attack works by placing a fake TypeScript library file in the repository and configuring VS Code settings to point to it—the extension loads and runs this fake library without asking permission or checking if the workspace is trusted. An attacker only needs to commit the malicious code to a repository (like on GitHub) and wait for developers to clone and open it.

• CVE-2026-50178HIGH 8.8

  The Angular Language Service extension for VS Code allows developers to write and debug Angular templates more effectively. However, the extension's server component doesn't properly clean up malicious code hidden in documentation comments (JSDoc) before displaying them as helpful tooltips. An attacker who controls a project file or sneaks malicious code into an npm package can embed a hidden command that runs when a developer hovers over and clicks a tooltip. This gives the attacker the ability to execute arbitrary commands on the developer's machine. The vulnerability is fixed in version 21.2.4.

• CVE-2026-50168HIGH 8.2

  Angular Server-Side Rendering (SSR) applications running on Node.js are vulnerable to Server-Side Request Forgery (SSRF) attacks when they enforce host allowlists to restrict backend requests. An attacker can craft a malformed URL with a double port (e.g., http://evil.com:80:80/path) that bypasses the allowlist validation but is still accepted by the underlying DOM parser, allowing the attacker to redirect server-side requests to arbitrary external endpoints. This affects versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-50170HIGH 7.5

  Angular applications using Server-Side Rendering (SSR) with hydration are vulnerable to unintended credential caching and data leakage. When Angular's HttpTransferCache utility prepares responses for the client, it doesn't check whether those requests included credentials or sensitive cookies. This means user-specific data—like personalized account information—can end up cached in the TransferState payload that gets baked into the HTML. If a CDN, reverse proxy, or shared cache layer then caches that HTML page, the next user to request the same page could receive the previous user's private data. The vulnerability affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-54268HIGH 7.5

  Angular's date formatting functionality contains a flaw that allows attackers to trigger excessive CPU and memory consumption on applications using the framework. By sending a specially crafted date format string—particularly one with repeating patterns or extreme length—an attacker can cause the application to slow dramatically or become unresponsive. This affects Angular's formatDate function and the widely-used DatePipe component. The vulnerability requires no authentication and can be exploited remotely, making it a practical denial-of-service vector for any internet-facing Angular application that accepts user-influenced date formatting parameters.

• CVE-2026-46417MEDIUM 6.1

  Angular's server-side rendering (SSR) engine contains a vulnerability that allows attackers to redirect application requests to attacker-controlled servers. When an Angular application accepts a malicious URL during SSR initialization, the platform can be tricked into treating that URL's domain as the legitimate application origin. This causes subsequent relative requests—such as API calls or hostname lookups—to go to the attacker's server instead of the intended destination. An attacker would need to control the initial URL passed to the rendering engine, typically through manipulation of a request parameter or similar vector. The vulnerability affects the @angular/platform-server package across multiple major versions.

• CVE-2026-50169MEDIUM 6.1

  Angular's Service Worker has a flaw in how it handles network requests for cached assets. When the Service Worker reconstructs requests, it accidentally strips away security settings that tell the browser not to follow redirects—instead forcing all redirects to be followed automatically. This can leak sensitive data if a public page redirects to a restricted area, since cookies and session tokens travel along. The vulnerability affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-50171MEDIUM 6.1

  Angular applications using number formatting features are vulnerable to a denial-of-service attack if an attacker can control the formatting instructions passed to number-display functions. An attacker crafting specially designed format strings with extremely large digit specifications can cause the application to enter an infinite loop that consumes memory and CPU, effectively freezing or crashing the app. This affects Angular's number, decimal, percent, and currency formatting pipes—features commonly used to display financial data, statistics, and user-facing numbers.

• CVE-2026-50184MEDIUM 6.1

  Angular's Service Worker package has a flaw where it unintentionally reverses security settings you've configured for network requests. When your application tells the browser not to send credentials (like cookies) on a particular request, or marks a response as non-cacheable, the Service Worker strips those instructions and applies default settings instead. This can leak session data or cache sensitive pages in local storage even after logout. The issue affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

• CVE-2026-50555MEDIUM 6.1

  Angular's server-side rendering (SSR) feature includes a vulnerability in how it handles the serialization of raw-text HTML elements like <script>, <style>, and <iframe> tags. When dynamic content containing certain Unicode characters (specifically astral characters like emojis) appears before a closing tag, the server fails to properly escape that closing tag. This allows an attacker to break out of the raw-text context and inject arbitrary JavaScript that executes in the victim's browser with the same origin privileges. The flaw affects Angular versions prior to specific patched releases and requires user interaction (such as clicking a link) to exploit.

• CVE-2026-50556MEDIUM 6.1

  Angular applications using Server-Side Rendering (SSR) are vulnerable to Cross-Site Scripting attacks when dynamic text is bound inside <noscript> elements. The vulnerability stems from a gap in how the underlying DOM emulation library (domino) escapes closing tags during HTML serialization. An attacker who can control content rendered within a <noscript> element can inject a closing tag that terminates the noscript block prematurely, allowing arbitrary JavaScript to execute in the user's browser with the application's privileges. The issue affects Angular versions prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

• CVE-2026-50557MEDIUM 6.1

  Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.22 contain a template sanitization bypass vulnerability that allows attackers to inject malicious scripts through specially crafted namespace-based HTML elements. By using namespaced variants like <svg:script> or <:svg:script>, attackers can circumvent Angular's built-in protections against script injection, potentially leading to cross-site scripting (XSS) attacks. The vulnerability also extends to namespaced attributes in SVG and MathML elements, which can bypass attribute sanitizers. Any application using a vulnerable Angular version that processes user-supplied or dynamically rendered templates is at risk.

• CVE-2026-52725MEDIUM 6.1

  Angular's dynamic component creation feature contains a security flaw that allows attackers to bypass script-execution protections. When an Angular application dynamically creates a component, the framework should prevent mounting that component onto dangerous HTML elements like <script> tags. This vulnerability fails to enforce that restriction, meaning an attacker who can control where a component is mounted could force it onto a script tag, causing arbitrary JavaScript code to execute in the user's browser. This is a client-side XSS vulnerability that requires user interaction and control over component placement to exploit.

• CVE-2026-54264MEDIUM 6.1

  Angular's Service Worker—a component that helps web applications work offline—has a flaw in how it handles redirects across different websites. When a Service Worker follows a redirect to another domain, it should remove sensitive information like login tokens before sending the request. Instead, it's currently passing those credentials along, potentially exposing them to untrusted external sites. An attacker can exploit this by crafting a scenario where a user's browser is redirected through the vulnerable Service Worker to a site the attacker controls, capturing credentials in the process. This affects Angular versions before 22.0.1, 21.2.17, and 20.3.25.

• CVE-2026-54265MEDIUM 6.1

  Angular versions prior to 22.0.1, 21.2.17, and 20.3.25 contain a vulnerability in the compiler that allows developers to accidentally create XSS vulnerabilities in their applications. The issue occurs when developers use Angular's two-way binding syntax (a shorthand for linking data both into and out of a component) on sensitive HTML properties like innerHTML or src. Under normal circumstances, Angular automatically cleans these properties to prevent malicious code injection. However, the two-way binding syntax bypasses that automatic cleaning, leaving applications vulnerable if they bind user-controlled data to these properties. An attacker who can influence what data gets bound could inject malicious JavaScript that runs in users' browsers.

• CVE-2026-54266MEDIUM 6.1

  Angular's server-side rendering (SSR) feature uses a weak caching mechanism to avoid repeating HTTP requests during client hydration. The cache relies on a 32-bit hash to identify which responses belong to which requests. Because this hash is weak, an attacker can craft a specially constructed URL with a query parameter that produces the same hash value as a sensitive endpoint. When a victim visits the attacker's link, both requests execute, but due to the collision, the wrong response gets cached and returned to the user. This could expose sensitive data like profile information by replacing it with attacker-controlled content, or vice versa.

• CVE-2026-54267MEDIUM 6.1

  Angular applications using server-side rendering (SSR) with client hydration are vulnerable to a DOM Clobbering attack that could allow attackers to inject or manipulate cached application state. When an Angular app serializes its runtime state (like HTTP responses) into an HTML script tag during SSR, the client-side code retrieves this state by searching for an element with the ID 'ng-state'. If an attacker can control user input or CMS content that sets element IDs before the legitimate script tag loads, they can create a fake 'ng-state' element. When Angular's hydration process looks for this element, it finds the attacker's version instead and attempts to parse its content as application state, potentially leading to information disclosure or application manipulation.