Listen to this Post
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler’s internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using `i18n-on` attributes (e.g., i18n-onerror).
When exploited, a lower-trust translation file could replace a benign static handler such as `onerror=”void 0″` with arbitrary executable JavaScript in the localized build. The following example illustrates a vulnerable pattern: <img src="foo.jpg" onerror="void 0" i18n-onerror />.
This vulnerability arises because the i18n metadata collection path does not enforce the same attribute validation restrictions as the standard attribute validation path. As a result, event-handler attributes that are marked for internationalization via `i18n-on` can be manipulated through translation files.
An attacker who can control or influence the translation files used during localization can inject arbitrary JavaScript code. This code executes within the context of the vulnerable application’s domain, leading to severe security consequences.
The vulnerability affects a wide range of Angular versions, including all releases up to 19.2.25, as well as versions 20.0.0-next.0 through 20.3.26, 21.0.0-next.0 through 21.2.18, and 22.0.0-next.0 through 22.0.0. Patched versions are 20.3.27, 21.2.19, and 22.0.1.
The issue is fixed in the patched versions by modifying the compiler’s attribute validation logic to prevent i18n event handlers from being processed in contexts where they could introduce executable code. This ensures that the i18n metadata collection path enforces the same restrictions as the standard attribute validation path.
DailyCVE Form:
Platform: Angular Framework
Version: <20.3.27, <21.2.19, <22.0.1
Vulnerability: XSS via i18n-on
Severity: High
date: 2026-07-29
Prediction: Already Patched
What Undercode Say:
Check Angular version ng version Check for vulnerable patterns in templates grep -r "i18n-on" . --include=".html" Example of a vulnerable template cat << EOF <img src="foo.jpg" onerror="void 0" i18n-onerror /> EOF Update to patched version npm install @angular/[email protected] @angular/[email protected] or for v21 npm install @angular/[email protected] @angular/[email protected] or for v20 npm install @angular/[email protected] @angular/[email protected]
Exploit:
An attacker can exploit this vulnerability by crafting a malicious translation file that replaces a benign static event handler with arbitrary JavaScript. For example, a translation file could change `onerror=”void 0″` to `onerror=”alert(‘XSS’)”` in the localized build. The attacker must be able to control or influence the translation files used during localization.
Protection:
- Upgrade Angular: Update to patched versions: 22.0.1, 21.2.19, or 20.3.27.
- Avoid i18n-on\ Attributes: Ensure that static event-handler attributes (e.g.,
onerror,onclick) are never marked for internationalization (i18n-on) in application templates. - Trusted Translation Sources: Ensure translation files are sourced from trusted origins.
Impact:
When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application’s domain. This can lead to:
– Session Hijacking: Accessing session cookies, tokens, or sensitive user data.
– Unauthorized Actions: Performing actions on behalf of the authenticated user.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
