Critical XSS Vulnerability in Angular i18n Enables Malicious Code Execution

A high-severity Cross-Site Scripting (XSS) vulnerability, designated as CVE-2026-27970, has been discovered in Angular’s internationalization (i18n) pipeline.

The vulnerability allows attackers to execute malicious JavaScript if they can compromise an application’s translation files.

Angular’s i18n process allows developers to extract application messages, translate them into different languages, and merge them back into the code.

This process often involves third-party translation services. The vulnerability lies in how Angular handles International Components for Unicode (ICU) messages.

HTML embedded within translated content was not adequately sanitized, creating an opening for arbitrary JavaScript execution.

Details	Information
CVE ID	CVE-2026-27970
Vulnerability	Cross-Site Scripting (XSS) in Angular i18n
Severity	High
Affected Package	@angular/core
Weakness	CWE-79
CVSS Vector	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Exploitation Prerequisites

Unlike typical XSS vulnerabilities that arbitrary users can exploit, CVE-2026-27970 requires a specific sequence of conditions:

The attacker must first compromise the application’s translation file (e.g., .xliff or .xtb). The targeted application must actively use Angular i18n and render at least one ICU message.

The application must lack strong defenses, such as a strong Content Security Policy (CSP) or Trusted Types.

If an attacker successfully manipulates the translation file and the malicious code is rendered into the application, they can execute JavaScript in the application’s origin.

This can result in severe consequences, including:

Threat Type	Description
Credential Exfiltration	Attackers steal sensitive data (page memory, LocalStorage, IndexedDB, cookies) and send it to an external server.
Page Vandalism	Attackers modify webpage content or behavior to deceive users or disrupt functionality.

Affected Versions and Patches

The vulnerability affects several versions of the @angular/core package.

Component	Version Range
@angular/core	>= 21.2.0-next.0 to <= 21.2.0-rc.0
@angular/core	>= 21.0.0-next.0 to <= 21.1.5
@angular/core	>= 20.0.0-next.0 to <= 20.3.16
@angular/core	>= 19.0.0-next.0 to <= 19.2.18
@angular/core	<= 18.2.14

Developers are strongly urged to update to the patched versions immediately to secure their applications.

Angular Developers on GitHub have released the necessary fixes and guidance for affected projects.

Organizations that cannot immediately apply the patches should implement the following workarounds to reduce risk:

Security Measure	Description
Verify Translations	Review and validate all third-party translated content before integrating into the Angular application.
Enable Strict CSP	Implement a strict Content Security Policy to block unauthorized JavaScript execution.
Enforce Trusted Types	Apply Trusted Types and proper HTML sanitization to prevent DOM-based XSS.

Developers are encouraged to review their Angular i18n implementations and apply the necessary updates or workarounds to protect against potential exploitation of CVE-2026-27970.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.