This page collects WhisperX intelligence signals tagged #Angular. It is designed for humans, search engines, and AI agents: each item links to a canonical source-backed record with sector, source, timestamp, credibility, and exportable structured data.
Googleが開発する主要なフロントエンドフレームワーク、Angularのコンパイラパッケージに、クロスサイトスクリプティング（XSS）の脆弱性が確認された。脆弱性は `@angular/compiler` のバージョン 20.3.17 に存在し、攻撃者が悪意のあるスクリプトを注入する可能性を開く。セキュリティ企業Snykによる評価では、CVSS v4.0のスコアは2.1で「低」深刻度とされているが、CVSS v3.1では4.4の「中」深刻度と評価されており、リスク評価に差異がある。現時点で、この脆弱性を悪用した攻撃は確認されていない。 この問題は、`@angular/[email protected]` を依存関係として使用してい...
Angular 框架的核心库 `@angular/[email protected]` 版本中被发现存在一个跨站脚本 (XSS) 安全漏洞。该漏洞的 CVSS v3.1 评分为 4.4（中危），而 Snyk 的 CVSS v4.0 评分为 2.1（低危）。目前，该漏洞尚未有已知的公开利用方式，但已确认通过特定路径引入，例如在 `[email protected]` 项目中依赖了受影响的版本。 漏洞的根源在于 `@angular/[email protected]` 版本。Angular 团队已在后续版本中修复了此问题，具体包括 `@angular/[email protected]`、`@20.3.18`、`@21.2.3` 和 `@22.0.0-next.2`...
A high-severity security flaw in the widely used `node-forge` cryptography library exposes Angular applications to potential cryptographic bypass attacks. The vulnerability, tracked as CVE-2025-12816, is an ASN.1 Validator Desynchronization flaw rated as HIGH severity. It exists in node-forge versions 1.3.1 and below, ...
A critical security vulnerability in the Angular framework's compiler component has been disclosed, prompting an urgent dependency update. The flaw, tracked as CVE-2026-22610 (GHSA-jrmj-c5cx-3cw6), involves a cross-site scripting (XSS) risk stemming from unsanitized SVG script attributes. This vulnerability could allow...
A critical security vulnerability has been identified in an Angular-based web application, where sensitive user session data is being stored in the browser's localStorage. This implementation flaw, located in the `error.interceptor.ts` file, directly exposes authentication tokens or user identities to any JavaScript co...
A critical security vulnerability in Angular's server-side rendering (SSR) framework has been patched, forcing a major dependency update. The fix, tracked as CVE-2026-27739, addresses a Server-Side Request Forgery (SSRF) flaw in the `@angular/ssr` package. This type of vulnerability allows attackers to trick a server i...
A high-severity vulnerability, CVE-2026-33891, has been identified in the widely used `node-forge` library version 0.10.0. This JavaScript library provides critical implementations for cryptography, ciphers, and PKI, making its security flaws a significant risk to any dependent application. The vulnerability was detect...
A newly disclosed vulnerability, CVE-2026-34043, has been flagged in a widely used JavaScript serialization library. The medium-severity flaw is present in version 6.0.0 of the `serialize-javascript` package, a tool that serializes JavaScript objects to a superset of JSON, including functions and regular expressions. T...
A critical security flaw in the Angular framework has been patched, exposing applications using internationalization (i18n) features to potential cross-site scripting (XSS) attacks. The vulnerability, tracked as CVE-2026-32635 and GHSA-g93w-mfhg-p222, resides within the Angular runtime's handling of i18n attribute bind...
A critical security flaw in the Angular framework has been patched, exposing applications using internationalization (i18n) to cross-site scripting (XSS) attacks. The vulnerability, tracked as CVE-2026-32635 (GHSA-g93w-mfhg-p222), resides within the `@angular/compiler` package. It specifically affects how Angular handl...
A critical security flaw in the Angular framework has been patched, exposing applications using internationalization (i18n) to cross-site scripting (XSS) attacks. The vulnerability, tracked as CVE-2026-32635 and GHSA-g93w-mfhg-p222, was present in the `@angular/compiler` package. This update, moving from version 21.1.3...
A critical security flaw in the Angular framework has been patched, exposing applications using internationalization (i18n) to cross-site scripting (XSS) attacks. The vulnerability, tracked as CVE-2026-32635 and GHSA-g93w-mfhg-p222, resides within the Angular runtime's handling of i18n attribute bindings. This specific...
A critical security flaw in the Angular framework's compiler has been patched, exposing applications using internationalization (i18n) to potential cross-site scripting (XSS) attacks. The vulnerability, tracked as CVE-2026-32635 and GHSA-g93w-mfhg-p222, specifically resides in how Angular handles i18n attribute binding...
A high-severity Cross-Site Scripting (XSS) vulnerability has been identified in the Angular development platform, exposing applications to potential code injection attacks. The flaw, tracked as CVE-2026-32635, resides in the Angular runtime and compiler. It allows attackers to bypass the framework's built-in sanitizati...
A critical security vulnerability has been identified in the Angular compiler, exposing applications to cross-site scripting (XSS) attacks through unsanitized SVG script attributes. The flaw, tracked as CVE-2026-22610 and GHSA-jrmj-c5cx-3cw6, necessitates an immediate dependency update from older versions, such as 14.2...
A critical security vulnerability in Angular's internationalization (i18n) module exposes applications to cross-site scripting (XSS) attacks. The flaw, tracked as CVE-2026-27970 and GHSA-prjf-86w9-mfqv, is present in versions prior to 21.2.0 of the @angular/core package. This is not a theoretical risk; the vulnerabilit...
A critical security vulnerability in the Angular framework's compiler component demands immediate attention from development teams. The flaw, tracked as CVE-2026-32635 and GHSA-g93w-mfhg-p222, is a Cross-Site Scripting (XSS) vulnerability specifically located within i18n (internationalization) attribute bindings. This ...
Angular 框架的核心组件 `@angular/compiler` 中发现一个高危安全漏洞，被标记为 CVE-2025-66412。该漏洞属于存储型跨站脚本攻击（Stored XSS），直接影响 Angular 模板编译器。这意味着攻击者可能通过精心构造的恶意模板，在用户浏览器中执行任意代码，从而窃取用户会话、篡改页面内容或进行其他恶意操作。该漏洞的严重性在于其位于框架的编译层，可能影响所有使用受影响版本构建的 Angular 应用。 漏洞详情显示，问题存在于 `@angular/compiler` 的 20.3.11 及更早版本中。Angular 官方安全团队已发布修复版本 20.3.18。依赖管理工具 Renovate 已...
Security researchers have identified a potential gap in Angular's production-mode security controls that may allow click-triggered cross-site scripting through specific attribute binding syntax. The vulnerability, reported through Angular's official GitHub issue tracker, centers on the interaction between `[attr.onclic...
A security gap in Angular's platform-server package leaves server-side rendering deployments exposed to Server-Side Request Forgery (SSRF) via HTTP absolute-form request targets. The vulnerability exists in the `parseUrl` function within `ServerPlatformLocation`, where a recent patch addressed protocol-relative and bac...