CVE-2026-54265: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54265 is a DOM property sanitization bypass vulnerability in Angular's @angular/compiler package that enables client-side Cross-Site Scripting (XSS). The flaw was discovered by researcher SkyZeroZx, published to the GitHub Advisory Database on June 15, 2026, and assigned GHSA-58w9-8g37-x9v5. It affects @angular/compiler versions ≤ 19.2.25, 20.0.0-next.0 through < 20.3.25, 21.0.0-next.0 through < 21.2.17, and 22.0.0-next.0 through < 22.0.1. The vulnerability carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (Github Advisory, Angular Security Advisory).

The root cause (CWE-79) lies in the Angular template compiler's resolve_sanitizers.ts phase, which failed to include ir.OpKind.TwoWayProperty in the set of operations subject to schema-derived sanitizer resolution. As a result, when sensitive native DOM properties such as innerHTML, srcdoc, src, href, data, or sandbox are bound using two-way syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the compiler emits the ɵɵtwoWayProperty instruction without the required sanitizer function (e.g., ɵɵsanitizeHtml), whereas the equivalent one-way [innerHTML]="value" binding correctly invokes the sanitizer. The fix, applied in commit 3c70270, adds OpKind.TwoWayProperty to the sanitizer resolution switch statement so two-way bindings receive the same sanitizer as one-way bindings (Angular PR #69107, Fix Commit). Exploitation requires three concurrent conditions: the application uses two-way binding on a sensitive DOM property, the bound value is influenced by user-controlled input, and no additional manual sanitization (e.g., via DomSanitizer) is applied (Angular Security Advisory).

Successful exploitation allows an attacker who can control the value of a two-way bound sensitive DOM property to inject and execute arbitrary JavaScript in the victim's browser context. This can result in session hijacking, sensitive data exposure (e.g., cookies, tokens, form data), and unauthorized actions performed on behalf of the authenticated user. Availability is not impacted, and the vulnerability is scoped to the client side with no direct server-side compromise (Github Advisory, Angular Security Advisory).

1. Identify a vulnerable Angular application: Locate an Angular application running @angular/compiler in an affected version range (≤ 19.2.25, 20.x < 20.3.25, 21.x < 21.2.17, or 22.x < 22.0.1) that uses two-way binding syntax on a sensitive DOM property such as innerHTML, srcdoc, src, href, data, or sandbox.
2. Locate a user-controlled input path: Identify a component where user-supplied data flows into a two-way bound sensitive property, for example: <div [(innerHTML)]="userContent"></div> where userContent is derived from URL parameters, form fields, or API responses without additional sanitization.
3. Craft a malicious payload: Prepare an XSS payload appropriate for the target property, such as <img src=x onerror=alert(document.cookie)> for innerHTML or javascript:alert(1) for href-type properties.
4. Deliver the payload: Supply the malicious value through the user-controlled input channel (e.g., URL query parameter, form submission, stored content) so it is assigned to the two-way bound property at runtime.
5. Trigger execution: Induce a victim user to visit or interact with the affected page. Because the Angular compiler omits the sanitizer function for TwoWayProperty ops, the payload is rendered unsanitized into the DOM, causing the browser to execute the injected script in the context of the application's origin (Angular Security Advisory, Angular PR #69107).

• Network: Unexpected outbound requests from the victim's browser to attacker-controlled domains (e.g., for cookie exfiltration or beacon calls) originating from the Angular application's origin; unusual fetch/XMLHttpRequest calls visible in browser developer tools or proxy logs.
• Logs: Web server or CDN access logs showing requests containing HTML/JavaScript payloads in query parameters or POST bodies targeting endpoints that feed two-way bound properties; Content Security Policy (CSP) violation reports referencing inline script execution or unexpected external script sources.
• Browser/Client: Unexpected JavaScript execution or DOM modifications on pages using [(innerHTML)], [(srcdoc)], [(src)], [(href)], [(data)], or [(sandbox)] two-way bindings; browser console errors related to CSP violations or unexpected script evaluation.

The primary remediation is to upgrade @angular/compiler (and the corresponding Angular packages) to a patched version: 22.0.1, 21.2.17, or 20.3.25. For Angular 19.x and earlier (which have no patched release), applications should be migrated to a supported major version. As a workaround, audit templates and replace two-way bindings on sensitive DOM properties (e.g., [(innerHTML)]="value") with one-way property bindings ([innerHTML]="value") combined with explicit event handlers, and apply manual sanitization via Angular's DomSanitizer before passing values to sensitive properties (Github Advisory, Angular Security Advisory).

The vulnerability was reported by community contributor SkyZeroZx and reviewed by Angular core team members JeanMeche and JoostK, who noted it was "a good catch" during the pull request review. The fix was merged on June 8, 2026, and the advisory was published on June 10, 2026. No significant broader media coverage or notable external researcher commentary beyond the Angular team's response has been identified at this time (Angular PR #69107, Angular Security Advisory).