Angular Security Alert: High-Severity SVG Flaw CVE-2026-22610 Exposes Apps to XSS

Angular has disclosed a high-severity vulnerability in the Template Compiler, tracked as CVE-2026-22610, which could allow attackers to bypass built-in protections and execute arbitrary JavaScript via SVG elements. With a CVSS score of 8.5, the flaw stems from the sanitization of specific SVG attributes, where the compiler fails to recognise href and xlink:href on SVG <script> elements as a Resource URL context, enabling potential XSS if untrusted data is bound to those attributes.

The advisory describes how an attacker could use Angular’s template binding (for example, <script [attr[.]href]="userInput">) to inject malicious payloads such as data:text/javascript URIs or external scripts. Patches have been released across multiple versions: 19.2.18, 20.3.16, 21.0.7 and 21.1.0-rc.0, and developers are urged to upgrade promptly.

If patching is not possible, the guidance is to stop using dynamic bindings for these attributes and to validate input against an allowlist of trusted URLs before it reaches the template, according to the disclosure.