Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
#VulnerabilityReport #Angular Angular Security Alert: High-Severity SVG Flaw CVE-2026-22610 Exposes Apps to XSS https://securityonline.info/angular-security-alert-high-severity-svg-flaw-cve-2026-22610-exposes-apps-to-xss/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet alerts about a newly disclosed high‑severity Angular SVG XSS vulnerability (CVE‑2026‑22610) without providing PoC, exploit, or patch details.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | angular | angular | - | node.js | - |
| App | angular | angular | 21.1.0 | node.js | - |
| App | angular | angular | 21.1.0 | node.js | - |
| App | angular | angular | 21.1.0 | node.js | - |
| App | angular | angular | 21.1.0 | node.js | - |
| App | angular | angular | 21.1.0 | node.js | - |