CVE-2026-54265: Angular Compiler DOM Sanitization Bypass via Two-Way Bindings

Technical summary

The vulnerability stems from incomplete sanitization logic in Angular's @angular/compiler package. When the template compiler processes two-way property bindings (using the [(property)]="value" or bindon-property="value" syntax) on native DOM properties that require schema-derived sanitization, it fails to apply the appropriate sanitizer function to the TwoWayProperty AST node. One-way bindings to the same properties correctly invoke sanitization, but two-way bindings do not, resulting in unsanitized content being rendered in the DOM. This affects sensitive properties including innerHTML, srcdoc, src, href, data, and sandbox attributes. The root cause is a gap in the compiler's property binding analysis where TwoWayProperty operations bypass the sanitization resolution logic that applies to other binding types.

Business impact

For organizations using Angular in production, this vulnerability represents a potential client-side XSS exposure in any application that uses two-way bindings on sensitive DOM properties. The severity depends on whether user input flows into these bindings and whether the application has implemented additional defense mechanisms. Web applications serving end-users face the greatest risk, particularly those handling sensitive data or operating in regulated environments. Teams may need to audit their codebase for affected binding patterns, refactor templates to use one-way bindings instead, or implement Content Security Policy and other compensating controls while patches are tested and deployed.

Affected systems

Angular applications using versions prior to 22.0.1, 21.2.17, and 20.3.25 are affected. This includes the current major release (22.x), the long-term support release (21.x), and the previous LTS release (20.x). Any application compiled with an affected version of @angular/compiler that uses two-way binding syntax on properties like innerHTML, srcdoc, src, href, data, or sandbox is potentially vulnerable. The vulnerability does not affect one-way bindings or applications that do not use two-way syntax on these specific properties.

Exploitability

Exploitation requires an attacker to control the value being bound to a vulnerable property and requires user interaction (clicking a link, opening a page, or interacting with the vulnerable component). The network vector is easily accessible, and the attack complexity is low—the template compiler produces the vulnerability automatically if the pattern exists in the code. However, this is primarily a developer-introduced risk rather than a supply-chain attack; the vulnerability manifests in an application's compiled output, not in the Angular library itself. Widespread automatic exploitation is unlikely, but any application with the vulnerable pattern and user-controlled input flowing into it is at direct risk.

Remediation

Upgrade to Angular 22.0.1, 21.2.17, or 20.3.25 or later, depending on which release line your application uses. After upgrading the @angular/compiler package, recompile your application. As a temporary mitigation before patching, audit your codebase for two-way bindings on sensitive properties (innerHTML, srcdoc, src, href, data, sandbox) and refactor them to use one-way bindings combined with explicit property assignment or event handlers. Additionally, implement or strengthen Content Security Policy headers to limit script injection impact, and ensure input validation and output encoding are in place for any dynamic content.

Patch guidance

Angular releases patches across three supported version lines. Determine your application's current Angular version and upgrade to the minimum patched version in that line: for Angular 22, upgrade to 22.0.1 or later; for Angular 21, upgrade to 21.2.17 or later; for Angular 20, upgrade to 20.3.25 or later. Use ng update or npm/yarn update commands to upgrade the @angular/compiler, @angular/core, and related packages. Test thoroughly in a staging environment, as compiler changes can occasionally affect template behavior. Verify patch version numbers in the official Angular release notes before deployment.

Detection guidance

Search your codebase for the two-way binding syntax `[(` combined with sensitive property names: look for patterns like `[(innerHTML)]`, `[(src)]`, `[(href)]`, `[(srcdoc)]`, `[(data)]`, or `[(sandbox)]`. Automated code scanning tools configured to detect these patterns will be effective. Runtime detection is more difficult but can be achieved by monitoring Content Security Policy violation reports or by instrumenting the DOM to track unexpected script execution. Compile your application with the affected Angular version and review the generated JavaScript for bindings that emit unsanitized property assignments to these sensitive attributes. Review deployment logs and browser console errors for any XSS-related warnings or security violations.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability deserves prompt attention because it affects a widely-used web framework and results in XSS, a high-impact client-side flaw. XSS vulnerabilities can compromise user sessions, steal credentials, and deface content. The low barrier to exploitation (no special privileges, easy network access, user interaction only) and the fact that affected applications must be recompiled with a patched compiler (forcing a deliberate development cycle) mean that remediation requires coordinated action. Organizations should prioritize applications that accept user input, handle sensitive data, or serve critical functions.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a MEDIUM severity. The score accounts for network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and the requirement for user interaction (UI:R). The impact is limited to confidentiality and integrity of the user's context (C:L, I:L), with no availability impact. While the score is moderate, the underlying risk—XSS via a compiler flaw—is substantial in practice. The user interaction requirement prevents completely unauthenticated attacks but does not eliminate risk for applications where users naturally visit attacker-controlled pages or interact with untrusted content. Organizations handling regulated data or providing critical services should treat this as higher priority than the base score alone suggests.

Frequently asked questions