compiler-19.2.20.tgz: 4 vulnerabilities (highest severity is: 8.1)

[mend-for-github-com]

Vulnerable Library - compiler-19.2.20.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-19.2.20.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (compiler version)	Remediation Possible**
CVE-2026-69151	High	8.1	compiler-19.2.20.tgz	Direct	@⁠angular/core - 21.2.19,@⁠angular/core - 20.3.27,@⁠angular/compiler - 21.2.19,@⁠angular/compiler - 22.0.1,@⁠angular/compiler - 20.3.27,@⁠angular/core - 22.0.1	❌
CVE-2026-88057	Medium	6.1	compiler-19.2.20.tgz	Direct	@⁠angular/core - 22.1.0,@⁠angular/compiler - 21.2.20,@⁠angular/core - 20.3.28,@⁠angular/core - 21.2.20,@⁠angular/compiler - 20.3.28,@⁠angular/compiler - 22.1.0	❌
CVE-2026-54265	Medium	5.4	compiler-19.2.20.tgz	Direct	https://github.com/angular/angular.git - v20.3.25,https://github.com/angular/angular.git - v21.2.17	✅
CVE-2026-50557	Medium	5.4	compiler-19.2.20.tgz	Direct	https://github.com/angular/angular.git - v21.2.15,https://github.com/angular/angular.git - v20.3.22,https://github.com/angular/angular.git - v19.2.22	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-69151

Vulnerable Library - compiler-19.2.20.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-19.2.20.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ compiler-19.2.20.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

Publish Date: 2026-08-03

URL: CVE-2026-69151

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jj27-h5hq-8x99

Release Date: 2026-08-03

Fix Resolution: @⁠angular/core - 21.2.19,@⁠angular/core - 20.3.27,@⁠angular/compiler - 21.2.19,@⁠angular/compiler - 22.0.1,@⁠angular/compiler - 20.3.27,@⁠angular/core - 22.0.1

CVE-2026-88057

Vulnerable Library - compiler-19.2.20.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-19.2.20.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ compiler-19.2.20.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @⁠angular/core and @⁠angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context. Applications unable to upgrade can use DomSanitizer.sanitize with SecurityContext.URL before assignment or restrict inputs to validated HTTP and HTTPS URL schemes. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.0.

Publish Date: 2026-09-10

URL: CVE-2026-88057

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hh8m-fm6v-7cvg

Release Date: 2026-09-10

Fix Resolution: @⁠angular/core - 22.1.0,@⁠angular/compiler - 21.2.20,@⁠angular/core - 20.3.28,@⁠angular/core - 21.2.20,@⁠angular/compiler - 20.3.28,@⁠angular/compiler - 22.1.0

CVE-2026-54265

Vulnerable Library - compiler-19.2.20.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-19.2.20.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ compiler-19.2.20.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @⁠angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Publish Date: 2026-06-22

URL: CVE-2026-54265

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-58w9-8g37-x9v5

Release Date: 2026-06-15

Fix Resolution: https://github.com/angular/angular.git - v20.3.25,https://github.com/angular/angular.git - v21.2.17

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-50557

Vulnerable Library - compiler-19.2.20.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-19.2.20.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ compiler-19.2.20.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @⁠angular/compiler and @⁠angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., "svg:script" (svg:script) or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-06-22

URL: CVE-2026-50557

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f3m7-gqxr-g87x

Release Date: 2026-06-15

Fix Resolution: https://github.com/angular/angular.git - v21.2.15,https://github.com/angular/angular.git - v20.3.22,https://github.com/angular/angular.git - v19.2.22

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.