https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:41:31 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/euvd-2026-328943 EUVD-2026-328943 https://cve.radiocsirt.org/vuln/euvd-2026-328943 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54265 <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]=&#34;value&#34; or bindon-innerHTML=&#34;value&#34;), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular&#39;s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]=&#34;value&#34; or bindon-innerHTML=&#34;value&#34;), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular&#39;s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54265 https://cve.radiocsirt.org/vuln/ghsa-58w9-8g37-x9v5 <p><strong>Affected:</strong> npm: @angular/compiler</p> <p>An issue in the `@angular/compiler` package allows bypassing DOM property sanitization through the use of two-way property bindings.</p> <p>Specifically, when a native DOM property that requires sanitization (such as `innerHTML`, `srcdoc`, `src`, `href`, `data`, or `sandbox`) is bound using the two-way binding syntax (e.g., `[(innerHTML)]=&#34;value&#34;` or `bindon-innerHTML=&#34;value&#34;`), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the `TwoWayProperty` operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized.</p> <p>This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular&#39;s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS).</p> <p>### Impact Any Angular application that uses two-way data binding (`[()]` or `bindon-`) on security-sensitive native DOM properties (like `innerHTML`, `href` on `&lt;a&gt;`, `src` on `&lt;img&gt;`/`&lt;iframe&gt;`, etc.) is vulnerable to this security bypass.</p> <p>Once exploited, this allows a malicious actor to supply an unsanitized property binding value that bypasses core sanitization constraints. This could lead to the execution of arbitrary JavaScript within the target user&#39;s browser context, potentially resulting in session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.</p> <p>### Attack Preconditions…</p> <p><strong>Affected:</strong> npm: @angular/compiler</p> <p>An issue in the `@angular/compiler` package allows bypassing DOM property sanitization through the use of two-way property bindings.</p> <p>Specifically, when a native DOM property that requires sanitization (such as `innerHTML`, `srcdoc`, `src`, `href`, `data`, or `sandbox`) is bound using the two-way binding syntax (e.g., `[(innerHTML)]=&#34;value&#34;` or `bindon-innerHTML=&#34;value&#34;`), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the `TwoWayProperty` operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized.</p> <p>This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular&#39;s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS).</p> <p>### Impact Any Angular application that uses two-way data binding (`[()]` or `bindon-`) on security-sensitive native DOM properties (like `innerHTML`, `href` on `&lt;a&gt;`, `src` on `&lt;img&gt;`/`&lt;iframe&gt;`, etc.) is vulnerable to this security bypass.</p> <p>Once exploited, this allows a malicious actor to supply an unsanitized property binding value that bypasses core sanitization constraints. This could lead to the execution of arbitrary JavaScript within the target user&#39;s browser context, potentially resulting in session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.</p> <p>### Attack Preconditions…</p> https://cve.radiocsirt.org/vuln/ghsa-58w9-8g37-x9v5 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54265 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:25.10: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]=&#34;value&#34; or bindon-innerHTML=&#34;value&#34;), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular&#39;s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:25.10: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]=&#34;value&#34; or bindon-innerHTML=&#34;value&#34;), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular&#39;s built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54265 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2038 <p>Ein Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um beliebigen Programmcode auszuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um beliebigen Programmcode auszuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2038