{"id":"EUVD-2026-38268","enisaUuid":"74e4f366-292d-3e87-ae0e-00898cf9395e","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]\u003d\"value\" or bindon-innerHTML\u003d\"value\"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular\u0027s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.","datePublished":"Jun 22, 2026, 3:27:38 PM","dateUpdated":"Jun 22, 2026, 3:54:58 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5\nhttps://github.com/angular/angular/pull/69107\nhttps://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4\n","aliases":"CVE-2026-54265\nGHSA-58w9-8g37-x9v5\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"204d1532-7bd9-34aa-ae78-2a640864fc11","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"4f8ae66d-296d-3a53-95a1-9147ee5eb512","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0-next.0 \u003c 20.3.25"},{"id":"72e931f3-118e-358c-9e3a-9cf4518b8edb","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0-next.0 \u003c 22.0.1"},{"id":"caf5e09a-2030-3fe3-8163-5c99f622925f","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0-next.0 \u003c 21.2.17"}],"enisaIdVendor":[{"id":"50c56219-e73a-3538-a913-6065823511dd","vendor":{"name":"angular"}}],"enisaIdVulnerability":[{"id":"256daaa8-0282-388e-93f3-ada3ab627001","vulnerability":{"id":"CVE-2026-54265","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]\u003d\"value\" or bindon-innerHTML\u003d\"value\"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular\u0027s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.","datePublished":"Jun 22, 2026, 3:27:38 PM","dateUpdated":"Jun 22, 2026, 3:54:58 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5\nhttps://github.com/angular/angular/pull/69107\nhttps://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4\n","enisa_id":"EUVD-2026-38268\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Nov 13, 2026, 7:20:56 AM","vulnerabilityProduct":[{"id":"013f6334-379c-35fd-9861-331a6379ef2c","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0-next.0 \u003c 21.2.17"},{"id":"7a2621bc-a1a1-37b0-87cf-af68f840a9ab","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0-next.0 \u003c 22.0.1"},{"id":"b0c1386d-388c-322c-b73d-74bf5112ffcd","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"cc45395e-762d-3fd6-8c15-0216b09cce07","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0-next.0 \u003c 20.3.25"}],"vulnerabilityVendor":[{"id":"dba5fd3d-7402-336c-ae12-5d00a8ca5fda","vendor":{"name":"angular"}}]}},{"id":"49cc2d24-80f4-3e08-859e-4853a77e7c0e","vulnerability":{"id":"GHSA-58w9-8g37-x9v5","description":"@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)","datePublished":"Jun 15, 2026, 5:22:40 PM","dateUpdated":"Jul 15, 2026, 10:03:42 PM","baseScore":0.0,"references":"https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54265\nhttps://github.com/angular/angular/pull/69107\nhttps://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4\nhttps://github.com/angular/angular\n","enisa_id":"EUVD-2026-38268\n","aliases":"CVE-2026-54265\nGHSA-58w9-8g37-x9v5\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:49:06 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}