CVE-2026-22610
Fixed in a distro release EPSS <1%CVSS 8.5
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.
Products: angular, Siemens RUGGEDCOM RST2428P, Siemens SIDIS Prime
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @angular/compiler | 21.1.0-rc.0 |
| npm | @angular/compiler | 21.0.7 |
| npm | @angular/compiler | 20.3.16 |
| npm | @angular/compiler | 19.2.18 |
| npm | @angular/compiler | no fix |
| npm | @angular/core | 21.1.0-rc.0 |
| npm | @angular/core | 21.0.7 |
| npm | @angular/core | 20.3.16 |
| npm | @angular/core | 19.2.18 |
| npm | @angular/core | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Debian 11 | angular.js | no fix |
| Debian 12 | angular.js | no fix |
| Debian 13 | angular.js | no fix |
| Debian 14 | angular.js | no fix |
| Ubuntu 22.04 LTS | angular.js | no fix |
| Ubuntu 24.04 LTS | angular.js | no fix |
| Ubuntu 25.10 | angular.js | no fix |
| Ubuntu 26.04 LTS | angular.js | no fix |
| Ubuntu 26.10 | angular.js | no fix |
| Ubuntu Pro 16.04 LTS | angular.js | no fix |
| Ubuntu Pro 18.04 LTS | angular.js | no fix |
| Ubuntu Pro 20.04 LTS | angular.js | no fix |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |