Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-32635 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Angular Angular Cli. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32635 is a cross-site scripting (XSS) vulnerability in the Angular runtime and compiler, affecting the open-source development platform for building mobile and desktop web applications using TypeScript, JavaScript, and other languages. The issue impacts Angular versions prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20. It arises when an application uses a security-sensitive attribute, such as href on an anchor tag, alongside Angular's internationalization feature by adding an i18n-<attribute> name. This configuration bypasses Angular's built-in sanitization, enabling malicious script injection through data binding to untrusted user-generated data. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) and is associated with CWE-79.
An attacker can exploit this vulnerability if they can influence data bound to the affected attribute in an Angular application that has internationalization enabled on security-sensitive attributes. Exploitation requires low privileges (PR:L), such as an authenticated user, and user interaction (UI:R), such as clicking a malicious link. Successful exploitation allows the attacker to inject and execute arbitrary scripts in the context of the victim's browser with changed scope (S:C), potentially leading to high impacts on confidentiality, integrity, and availability, including theft of sensitive data, session hijacking, or full application compromise.
The Angular security advisory (GHSA-g93w-mfhg-p222) and associated pull requests (#67541 and #67561) confirm the vulnerability has been fixed in Angular versions 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20. Security practitioners should advise developers to upgrade to these patched versions immediately and review applications for improper use of i18n on sensitive attributes bound to untrusted inputs, disabling internationalization on such attributes where possible as an interim measure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12140
Vulnerability Data
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs…
more
when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect input neutralization through targeted web-application tests.
Input validation directly enforces neutralization of untrusted data before it reaches web output generation.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Requiring language-specific secure-coding standards and automated scanning during the SDLC catches missing output encoding or improper neutralization of untrusted data before the software reaches production.
Secure-coding standards, SAST scans and removal of insecure code samples together eliminate the failure to neutralize script content that produces cross-site scripting flaws.
Webpage malware scanning and block-listing of known malicious sites reduce the likelihood that reflected or stored script payloads reach a user’s browser.