CVE-2026-22610: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22610 is a Cross-Site Scripting (XSS) vulnerability in the Angular Template Compiler, specifically affecting the @angular/compiler and @angular/core npm packages. The flaw was disclosed on January 8, 2026, and affects all Angular versions up to and including 18.2.14, versions 19.x prior to 19.2.18, 20.x prior to 20.3.16, and 21.x prior to 21.0.7 (including certain 21.1.0-next pre-releases). It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 8.5 (High) (Github Advisory, Angular Security Advisory).

The root cause (CWE-79) is Angular's internal DOM security schema failing to classify the href and xlink:href attributes of SVG <script> elements as Resource URL contexts. Because these attributes are not recognized as security-sensitive, the Angular Template Compiler treats attacker-controlled values bound to them (e.g., <script [attr.href]="userInput">) as ordinary strings rather than resource links, bypassing Angular's built-in sanitization. This allows an attacker to supply a malicious payload such as a data:text/javascript URI or a link to an external script. The fix, merged in PR #66318, updates dom_security_schema.ts to add script|href and script|xlink:href to the Resource URL security context, and updates sanitization.ts to route these attributes through ɵɵsanitizeResourceUrl (Angular Security Advisory, Patch Commit). Exploitation requires three preconditions: the application must use SVG <script> elements in templates, must use property/attribute binding for href or xlink:href, and the bound data must originate from an untrusted source.

Successful exploitation allows arbitrary JavaScript execution within the victim's browser session, enabling session hijacking (theft of cookies, localStorage data, or authentication tokens), data exfiltration of sensitive information rendered in the application, and unauthorized state-changing actions performed on behalf of the authenticated user. The vulnerability's scope is limited to client-side browser execution; it does not directly compromise server-side systems, but can facilitate account takeover or credential theft that enables further lateral movement (Angular Security Advisory, Github Advisory).

A public proof-of-concept exploit has been published on GitHub at https://github.com/ashizZz/CVE-2026-22610, added approximately January 18, 2026 (Feedly). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.044% (1st percentile), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 282567) and Qualys (plugin 151082) (Github Advisory).

1. Identify a vulnerable application: Locate an Angular web application using a version prior to the patched releases (≤18.2.14, 19.x < 19.2.18, 20.x < 20.3.16, 21.x < 21.0.7) that renders SVG content with dynamic template bindings.
2. Confirm the attack surface: Inspect the application's Angular templates (via source maps, browser DevTools, or decompiled bundles) for SVG <script> elements using [attr.href] or [attr.xlink:href] bindings tied to user-controlled or API-sourced data.
3. Craft a malicious payload: Prepare a value that will be injected into the href or xlink:href attribute of the SVG <script> element, such as data:text/javascript,alert(document.cookie) or a URL pointing to an attacker-controlled external script.
4. Deliver the payload: Supply the malicious value through the application's input vector — for example, a URL parameter, a form field, a database entry, or an API response — that feeds into the vulnerable template binding.
5. Trigger execution: Induce the victim user to visit the page or view the content containing the injected SVG <script> element. Because Angular's sanitizer does not treat these attributes as Resource URLs in vulnerable versions, the browser loads and executes the attacker's script.
6. Achieve objective: The executed JavaScript runs in the victim's browser session, enabling cookie/token theft, keylogging, form hijacking, or exfiltration of sensitive data displayed in the application (Angular Security Advisory, Github Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains shortly after loading an Angular application page; requests to attacker-controlled servers carrying encoded session tokens or cookie data in query parameters or POST bodies.
• Logs: Web server or CDN access logs showing unusual query parameters or path segments containing data:text/javascript strings or encoded script URIs in requests to Angular application routes; Content Security Policy (CSP) violation reports referencing unexpected script sources.
• Browser/Client-Side: Presence of data:text/javascript or external script URLs in the href or xlink:href attributes of SVG <script> elements when inspecting the DOM of the application; unexpected JavaScript execution or network requests initiated from within SVG content.
• Application: User reports of unexpected behavior such as unauthorized actions, session invalidation, or account compromise following interaction with specific application pages that render SVG content.

Angular has released patched versions addressing this vulnerability: 18.2.15 (for the 18.x LTS branch), 19.2.18, 20.3.16, and 21.0.7 (or 21.1.0-rc.0 for the release candidate branch). Organizations should upgrade to the appropriate patched version as the primary remediation. As a temporary workaround prior to patching, developers should avoid using Angular template binding (e.g., [attr.href]) for SVG <script> elements entirely, and strictly validate any dynamic values against a server-side allowlist of trusted URLs before they reach the template. Additionally, implementing a strict Content Security Policy (CSP) that restricts script-src to trusted origins can significantly reduce the exploitability of this and similar XSS vulnerabilities. IBM has also released patches for affected downstream products including IBM Informix HQ 3.2.2 and IBM Rapid Infrastructure Automation (Angular Security Advisory, Github Advisory).

The vulnerability received coverage from multiple security news outlets including GBHackers, CyberSecurityNews, and SecurityOnline, which highlighted the risk of arbitrary JavaScript execution in Angular applications (SecurityOnline). HeroDevs published a detailed blog post framing the vulnerability in the context of end-of-life Angular versions and the broader challenge of framework security for organizations running unsupported releases. The Hacker News weekly recap included CVE-2026-22610 among notable vulnerabilities disclosed in January 2026. Community discussion on LinkedIn and Bluesky noted the nuanced preconditions required for exploitation, with some researchers emphasizing that the vulnerability is not trivially exploitable in most real-world applications due to the specific template patterns required.