THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-jj27-h5hq-8x99 (high) — Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

[GHSA] GHSA-jj27-h5hq-8x99 (high) — Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

medgithub_advisoriesPublished 2026-08-03

GHSA-jj27-h5hq-8x99 Severity: high CVE: CVE-2026-69151

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAtt

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-69151cve

Original source: https://github.com/advisories/GHSA-jj27-h5hq-8x99