CVE-2026-69151: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler’s internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).
When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.
The following example illustrates a vulnerable pattern:
<img src="foo.jpg" onerror="void 0" i18n-onerror />
References
- github.com/advisories/GHSA-jj27-h5hq-8x99
- github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e
- github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865
- github.com/angular/angular/pull/68821
- github.com/angular/angular/pull/69306
- github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99
- nvd.nist.gov/vuln/detail/CVE-2026-69151
Code Behaviors & Features
Detect and mitigate CVE-2026-69151 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →