chore(deps): update dependency @angular/core to v20.3.28 [security] by github-actions[bot] · Pull Request #58 · AmadeusITGroup/renovate-playground

github-actions · 2026-07-18T07:48:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/core (source)	`20.3.18` → `20.3.28`

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

CVE-2026-50557 / GHSA-f3m7-gqxr-g87x

More information

Details

An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.

Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.

Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.

Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:

User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.

Patches

22.0.0-rc.2
21.2.15
20.3.22
19.2.23

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

CVE-2026-52725 / GHSA-692r-grfm-v8x7

More information

Details

An issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation.

Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts.

This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that registers dynamic components based on user-supplied parameters (like selectors or host elements) is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to mount a dynamic component on a script tag, bypassing core dynamic component creation safeguards to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:

User-Controlled Host Selection: The application must accept user-controlled inputs that are passed as a selector/host element to createComponent.
Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the dynamic creation APIs.

Patches

22.0.0-rc.2
21.2.15
20.3.22
19.2.23

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

CVE-2026-54267 / GHSA-rgjc-h3x7-9mwg

More information

Details

To optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a <script> tag with a predictable identifier:

<script type="application/json" id="ng-state">
    {"some-api-url": {"body": ...}}
</script>

During client bootstrap, Angular recovers this state by looking up the element via document.getElementById('ng-state') and parsing its text content.

Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (ng-state), it is susceptible to DOM Clobbering.

If the application binds untrusted user input or CMS content to element properties such as id (e.g., <div [id]="userInput"> or <a id="ng-state">) before the genuine <script> tag is parsed by the browser, the attacker-controlled element takes precedence in the DOM lookup.

During hydration, when Angular calls document.getElementById('ng-state'), the browser returns the attacker's clobbered element. Angular then attempts to parse the text content or attributes of this clobbered element as JSON.

Impact

By clobbering the state element, the attacker can inject a custom JSON payload into Angular's TransferState cache. The most critical exploitation vector is poisoning the HTTP Transfer Cache.

The attacker injects a clobbered ng-state element containing custom JSON.
The JSON maps a key (representing a target API endpoint URL) to a malicious payload of the attacker's choice.
During client-side initialization, Angular's HttpClient checks TransferState before making requests. Finding the poisoned key, HttpClient returns the forged response instantly instead of requesting the genuine backend API.

Depending on how the application processes and renders the affected API response, this can lead to:

DOM-based Cross-Site Scripting (XSS) if poisoned fields are rendered using unsafe bindings.
Privilege Escalation by spoofing user info or session details retrieved from poisoned API payloads.
UI Hijacking and redirection by spoofing configuration endpoints.

Patched Versions

22.0.1
21.2.17
20.3.25

Workarounds

If you cannot immediately update to a patched Angular version, apply the following workarounds:

A. Avoid Dynamic/User-Controlled IDs

Avoid binding raw user-supplied values or dynamic CMS IDs directly to element attributes. If dynamic IDs are required, sanitize them or prepend a static safe prefix:

<!-- Vulnerable Pattern -->
<div [id]="userControlledInput">...</div>

<!-- Mitigated Pattern -->
<div [id]="'safe-prefix-' + userControlledInput">...</div>

B. Configure a Custom Application ID

Declaring a unique, non-predictable APP_ID changes the ID suffix of the state element, making it harder for attackers to predict and target:

// app.config.ts

import { APP_ID } from '@&#8203;angular/core';
import { provideClientHydration } from '@&#8203;angular/platform-browser';

export const appConfig = {
  providers: [
    { provide: APP_ID, useValue: 'unique-obfuscated-app-id' },
    provideClientHydration()
  ]
};

This changes the state element lookup ID from ng-state to unique-obfuscated-app-id-state.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

CVE-2026-69151 / GHSA-jj27-h5hq-8x99

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).

When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.

The following example illustrates a vulnerable pattern:

<img src="foo.jpg" onerror="void 0" i18n-onerror />

Impact

When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to:

Session Hijacking: Accessing session cookies, tokens, or sensitive user data.
Unauthorized Actions: Performing actions on behalf of the authenticated user.

Patched Versions

22.0.1
21.2.19
20.3.27

Workarounds

Ensure that static event-handler attributes (e.g., onerror, onclick) are never marked for internationalization (i18n-on*) in application templates, and ensure translation files are sourced from trusted origins.

Severity

CVSS Score: 7.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

CVE-2026-88057 / GHSA-hh8m-fm6v-7cvg

More information

Details

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS).

Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.

When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:

hostDirectives composition,
Class inheritance of host bindings,
Dynamic component instantiation (createComponent with custom hostElement or dynamic directives),
Elements with SVG/MathML namespaces (e.g. <svg:a>, <math>), or
Elements using tag-neutral selectors (e.g. :not(...)),

the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. javascript:... URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.

Impact

An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).

Patches

This issue has been resolved in versions:

22.1.0
21.2.20
20.3.28

Workarounds

Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict the input to validated safe URL schemes (e.g. http://, https://).

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/core)

`v20.3.28`

Compare Source

core

Commit	Type	Description
2f96c8020f	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
969133d426	fix	match header values exactly when deleting
29dd26bd71	fix	preserve immutability of materialized clones
e4c416c20a	fix	run root interceptors in the terminal request chain

`v20.3.27`

Compare Source

compiler

Commit	Type	Description
5dbcd0ee16	fix	disallow i18n event attributes
db0d4a1a39	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
a64e2883e9	fix	distinguish repeated transfer cache params

platform-server

Commit	Type	Description
6f80cca0b8	fix	update domino to latest version

`v20.3.26`

Compare Source

compiler-cli

Commit	Type	Description
406aaa31e6	fix	update babel dependencies to latest v7

core

Commit	Type	Description
26831d0cbd	fix	avoid caching missing locale data
8eb7aea08b	fix	reject dynamic script host elements

http

Commit	Type	Description
b963f61028	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1fdf234168	fix	preserve referrer in asset requests
baa093ba68	fix	preserve referrer policy in asset requests

`v20.3.25`

Compare Source

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
a68ec702a0	fix	sanitize two-way properties

core

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

http

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

platform-server

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

service-worker

Commit	Type	Description
d65a5f457b	fix	Strips sensitive headers on cross-origin redirects

`v20.3.24`

Compare Source

platform-server

Commit	Type	Description
6ca433e56b	fix	throw on suspicious URLs and restrict protocol-relative URLs
8680b5152f	fix	update domino to latest version

`v20.3.23`

Compare Source

compiler

Commit	Type	Description
d40acc6431	fix	prevent namespaced SVG <style> elements from being stripped

`v20.3.22`

Compare Source

common

Commit	Type	Description
3d135ce59b	fix	add upper bounds for digitsInfo
39a4b4cc8e	fix	sanitize placeholder

compiler

Commit	Type	Description
8f35b182b1	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68926)
64a89e917a	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68926)
6404edfe0a	fix	strip namespaced SVG script elements during template compilation (#68926)

core

Commit	Type	Description
e345a58069	fix	normalize tag names in runtime i18n attribute security context lookup (#68926)
d86e4e7b2a	fix	reject script element as a dynamic component host (#68926)
af04936045	fix	sanitize meta selectors
dc631efa96	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68926)
909ef047b3	fix	synchronize core sanitization schema with compiler (#68926)

http

Commit	Type	Description
de7b2a62e7	fix	exclude withCredentials requests from transfer cache
4233188d8e	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
49a60f6045	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
5fdfd8a998	fix	preserve redirect policy on reconstructed asset requests
83b022f2d0	fix	Preserves explicit 'credentials: omit' in asset requests
e617fa06eb	fix	Preserves HTTP cache mode in asset group requests

`v20.3.21`

Compare Source

platform-server

Commit	Type	Description
f584840e2e	fix	add `allowedHosts` option to `renderModule` and `renderApplication`

`v20.3.20`

Compare Source

core

Commit	Type	Description
a9bcffdbc7	fix	disallow event attribute bindings in host bindings unconditionally (#68468)
97eeb45cfa	fix	validate security-sensitive attributes in i18n bindings (#68468)

platform-server

Commit	Type	Description
25e4e07238	fix	ensure origin has a trailing slash when parsing url (#68468)

`v20.3.19`

Compare Source

platform-server

Commit	Type	Description
303d4cd580	fix	prevent SSRF bypasses via protocol-relative and backslash URLs

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

github-actions Bot added the dependencies Pull requests that update a dependency file label Jul 18, 2026

github-actions Bot force-pushed the renovate/npm-angular-core-vulnerability branch from 8dc76eb to 9c12b2f Compare July 19, 2026 08:15

github-actions Bot force-pushed the renovate/npm-angular-core-vulnerability branch 2 times, most recently from 39fb708 to 20312e4 Compare August 4, 2026 08:35

github-actions Bot changed the title ~~chore(deps): update dependency @angular/core to v20.3.25 [security]~~ chore(deps): update dependency @angular/core to v20.3.27 [security] Aug 4, 2026

github-actions Bot force-pushed the renovate/npm-angular-core-vulnerability branch from 20312e4 to fb4ff2b Compare September 6, 2026 10:17

chore(deps): update dependency @angular/core to v20.3.28 [security]

769be06

github-actions Bot force-pushed the renovate/npm-angular-core-vulnerability branch from fb4ff2b to 769be06 Compare September 11, 2026 10:38

github-actions Bot changed the title ~~chore(deps): update dependency @angular/core to v20.3.27 [security]~~ chore(deps): update dependency @angular/core to v20.3.28 [security] Sep 11, 2026

Navigation Menu

chore(deps): update dependency @angular/core to v20.3.28 [security] - #58

chore(deps): update dependency @angular/core to v20.3.28 [security]#58
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/npm-angular-core-vulnerability

github-actions Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

Details

Impact

Attack Preconditions

Patches

Severity

References

@​angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

Details

Impact

Attack Preconditions

Patches

Severity

References

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

Details

Impact

Patched Versions

Workarounds

A. Avoid Dynamic/User-Controlled IDs

B. Configure a Custom Application ID

Severity

References

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Details

Impact

Patched Versions

Workarounds

Severity

References

Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

core

http

compiler

http

platform-server

compiler-cli

core

http

service-worker

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

platform-server

compiler

common

compiler

core

http

platform-server

service-worker

platform-server

core

platform-server

platform-server

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

github-actions Bot commented Jul 18, 2026 •

edited

Loading

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler