PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54265 angular CVE debrief

CVE-2026-54265 is a medium-severity vulnerability in the @angular/compiler package of the Angular development platform. The issue allows an attacker to bypass DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization, such as innerHTML or src, is bound using the two-way binding syntax, the Angular template compiler fails to apply the appropriate schema-derived sanitizer resolution. This flaw can lead to client-side Cross-Site Scripting (XSS) if an attacker can control the value of a two-way bound sensitive property. The vulnerability is fixed in versions 22.0.1, 21.2.17, and 20.3.25 of Angular.

Vendor
angular
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-07-09
Advisory published
2026-06-22
Advisory updated
2026-07-09

Who should care

Developers and security teams using Angular versions prior to 22.0.1, 21.2.17, or 20.3.25 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing their applications for usage of two-way property bindings with sensitive properties and updating to a patched version of Angular. Additionally, developers should ensure that user-input data is properly sanitized and validated to prevent potential XSS attacks.

Technical summary

The vulnerability exists in the @angular/compiler package of the Angular development platform. When a native DOM property that requires sanitization is bound using the two-way binding syntax, the Angular template compiler fails to apply the appropriate schema-derived sanitizer resolution. This results in native two-way DOM bindings being emitted without the required sanitizer function, potentially leading to client-side Cross-Site Scripting (XSS). The CVSS score for this vulnerability is 5.3, indicating a medium severity level.

Defensive priority

Apply patches: Update to Angular versions 22.0.1, 21.2.17, or 20.3.25. Review applications for usage of two-way property bindings with sensitive properties.

Recommended defensive actions

  • Apply patches: Update to Angular versions 22.0.1, 21.2.17, or 20.3.25.
  • Review applications for usage of two-way property bindings with sensitive properties.
  • Ensure user-input data is properly sanitized and validated.
  • Monitor applications for potential XSS attacks.
  • Consider implementing additional security measures, such as Content Security Policy (CSP).

Evidence notes

The CVE-2026-54265 vulnerability was publicly disclosed on June 22, 2026, and has a CVSS score of 5.3, indicating a medium severity level. The vulnerability affects various versions of Angular, including 22.0.0, 21.2.16, and 20.3.24. Patches are available in versions 22.0.1, 21.2.17, and 20.3.25.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54265 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54265

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54265 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54265

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.