CVE-2026-69151: angular

csirt@kutim:~/threat-intel/cve/CVE-2026-69151

CVSS 6.1 · Medium EPSS 0,33%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada angular. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

Rincian

Terbit di NVD: 3 Agustus 2026
Terakhir diubah: 11 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,33% peluang dieksploitasi; lebih tinggi dari 24,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
angular	angular	Semua versi hingga 19.2.25
angular	angular	Versi 20.0.0 hingga sebelum 20.3.27
angular	angular	Versi 21.0.0 hingga sebelum 21.2.19
angular	angular	Versi 22.0.0 hingga sebelum 22.0.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99 mitigasi · advisory vendor
https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e patch
https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865 patch
https://github.com/angular/angular/pull/68821 issue tracking
https://github.com/angular/angular/pull/69306 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.