CVE-2026-69151
Awaiting Analysis Awaiting Analysis - Queue

i18n Event Handler Injection in Angular

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69151
EUVD
EUVD-2026-52369

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
angular angular_compiler 20.3.27
angular angular_compiler 21.2.19
angular angular_compiler 22.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Angular compiler's i18n pipeline. It allows translation files to inject executable JavaScript by replacing static event-handler attributes like i18n-onerror. Fixed in versions 20.3.27, 21.2.19, and 22.0.1.

Detection Guidance

This vulnerability involves the Angular compiler's i18n pipeline allowing executable JavaScript via i18n-onerror and similar attributes. Detection requires checking Angular versions and inspecting translation files for malicious event handlers. No direct network or system commands are provided in the context.

Impact Analysis

An attacker could craft a malicious translation file to execute arbitrary JavaScript in a user's browser when the affected Angular application is loaded. This could lead to data theft, session hijacking, or other malicious activities.

Compliance Impact

This vulnerability allows executable JavaScript to be injected via translation files, which could lead to unauthorized data access or manipulation. This may violate GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Angular to versions 20.3.27, 21.2.19, or 22.0.1 or later to address the i18n pipeline vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69151. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart