Angular: Two-Way Property Binding Sanitization Bypass (XSS)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-54265 · CVE overview and exploitation status

EUVD-2026-38268

GHSA-58w9-8g37-x9v5

cve-program · CVE-2026-54265

• https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5
• https://github.com/angular/angular/pull/69107
• https://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4

euvd · EUVD-2026-38268

• https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5
• https://github.com/angular/angular/pull/69107
• https://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4

nvd · CVE-2026-54265

• https://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4
• https://github.com/angular/angular/pull/69107
• https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5

osv · GHSA-58w9-8g37-x9v5

• https://github.com/angular/angular/security/advisories/GHSA-58w9-8g37-x9v5
• https://nvd.nist.gov/vuln/detail/CVE-2026-54265
• https://github.com/angular/angular/pull/69107
• https://github.com/angular/angular/commit/3c70270c96677c0dd33585f2afe8e187113e5fb4
• https://github.com/angular/angular

• Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM proper… · Advisory content revised · 15 Nov 2026