CVE-2026-69151
Fixed in a distro release EPSS <1%CVSS 7.6
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Products: angular, @angular compiler, @angular core
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @angular/compiler | 22.0.1 |
| npm | @angular/compiler | 21.2.19 |
| npm | @angular/compiler | 20.3.27 |
| npm | @angular/compiler | no fix |
| npm | @angular/core | 22.0.1 |
| npm | @angular/core | 21.2.19 |
| npm | @angular/core | 20.3.27 |
| npm | @angular/core | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Debian 12 | angular.js | no fix |
| Debian 13 | angular.js | no fix |
| Ubuntu 22.04 LTS | angular.js | no fix |
| Ubuntu 24.04 LTS | angular.js | no fix |
| Ubuntu 26.04 LTS | angular.js | no fix |
| Ubuntu 26.10 | angular.js | no fix |
| Ubuntu Pro 16.04 LTS | angular.js | no fix |
| Ubuntu Pro 18.04 LTS | angular.js | no fix |
| Ubuntu Pro 20.04 LTS | angular.js | no fix |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |