CVE-2026-69151 in compiler core
Summary
by MITRE • 08/03/2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability described affects the Angular development platform's internationalization i18n pipeline, specifically targeting versions prior to 20.3.27, 21.2.19, and 22.0.1. This represents a critical security flaw that exploits the way Angular processes translation files containing i18n event handlers, creating potential execution paths for malicious code injection. The issue stems from insufficient validation of translation attributes within the compilation process, allowing untrusted translation data to override static JavaScript handlers with executable content.
The technical implementation of this vulnerability occurs within Angular's i18n compiler where the system processes internationalization attributes including i18n-onerror and other i18n-on event-handler attributes. When translation files are parsed and compiled, these attributes can contain executable JavaScript code that gets injected into the application runtime environment. This creates an attack surface where malicious actors can craft translation files that, when processed by the Angular compiler, result in arbitrary code execution within the context of the web application. The flaw specifically leverages the trust model between the application code and its translation assets, allowing lower-trust translation content to override higher-trust static handlers.
From an operational perspective, this vulnerability poses significant risks to applications that rely on dynamic translation files or third-party localization resources. Attackers could potentially compromise applications by uploading malicious translation files that contain JavaScript payloads designed to exploit other vulnerabilities or exfiltrate data from the application. The impact extends beyond simple code injection as it can enable more sophisticated attacks including cross-site scripting, privilege escalation within the application context, or even complete application compromise depending on the execution environment and available permissions. This vulnerability directly aligns with CWE-94, which describes the weakness of allowing arbitrary code execution through insufficient input validation.
The mitigation strategy involves updating Angular applications to versions 20.3.27, 21.2.19, or 22.0.1 where the i18n pipeline has been hardened to reject potentially malicious event handler attributes. Organizations should implement comprehensive patch management processes to ensure all Angular dependencies are updated to secure versions. Additionally, security teams should review translation file sources and implement strict validation controls for any external or third-party localization resources. The fix addresses the root cause by modifying the compiler's attribute validation logic to prevent i18n event handlers from being processed in contexts where they could introduce executable code. This remediation aligns with ATT&CK technique T1059.007 which covers JavaScript and VBScript, as it prevents malicious code injection through legitimate application interfaces. Organizations should also consider implementing runtime monitoring to detect anomalous behavior patterns that might indicate exploitation attempts, particularly focusing on unexpected JavaScript execution within translation processing contexts.