CVE-2026-27970

A Cross-site Scripting (XSS) vulnerability has been identified in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript.

Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user.

If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript.

Attach Preconditions

• The attacker must compromise the translation file (xliff, xtb, etc.).
• Unlike most XSS vulnerabilities, this one is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client.
• The victim application must use Angular i18n.
• The victim application must use one or more ICU messages.
• The victim application must render an ICU message.
• The victim application must not defend against XSS via a safe Content-Security Policy (CSP) or Trusted Types.

Workarounds

Until the patch is applied, developers should consider:

• Reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application.
• Enabling strict CSP controls to block unauthorized JavaScript from executing on the page.
• Enabling Trusted Types to enforce proper HTML sanitization.

References

• Fix

When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to:

• Credential Exfiltration: Stealing sensitive user data stored in page memory, LocalStorage, IndexedDB, or cookies available to JS and sending them to an attacker controlled server.
• Page Vandalism: Mutating the page to read or act differently than intended by the developer.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-27970 has a CVSS score of 6.1 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (21.2.0, 21.1.6, 20.3.17, 19.2.19); upgrading removes the vulnerable code path.

Kodem intelligence

• 21.2.0
• 21.1.6
• 20.3.17
• 19.2.19

1. What is CVE-2026-27970? CVE-2026-27970 is a high-severity cross-site scripting (XSS) vulnerability in @angular/core (npm), affecting versions >= 21.2.0-next.0, <= 21.2.0-rc.0. It is fixed in 21.2.0, 21.1.6, 20.3.17, 19.2.19. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-27970? CVE-2026-27970 has a CVSS score of 6.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of @angular/core are affected by CVE-2026-27970? @angular/core (npm) versions >= 21.2.0-next.0, <= 21.2.0-rc.0 is affected.
4. Is there a fix for CVE-2026-27970? Yes. CVE-2026-27970 is fixed in 21.2.0, 21.1.6, 20.3.17, 19.2.19. Upgrade to this version or later.
5. Is CVE-2026-27970 exploitable, and should I be worried? Whether CVE-2026-27970 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-27970 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-27970?
   • Upgrade @angular/core to 21.2.0 or later
   • Upgrade @angular/core to 21.1.6 or later
   • Upgrade @angular/core to 20.3.17 or later
   • Upgrade @angular/core to 19.2.19 or later