CVE-2026-69151: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler’s internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).
When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.
The following example illustrates a vulnerable pattern:
<img src="foo.jpg" onerror="void 0" i18n-onerror />
References
- github.com/advisories/GHSA-jj27-h5hq-8x99
- github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e
- github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865
- github.com/angular/angular/pull/68821
- github.com/angular/angular/pull/69306
- github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99
- nvd.nist.gov/vuln/detail/CVE-2026-69151
Code Behaviors & Features
Detect and mitigate CVE-2026-69151 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →