CVE-2026-22610

A flaw was found in Angular. An attacker could exploit a cross-site scripting (XSS) vulnerability in the Angular Template Compiler due to improper sanitization of href and xlink:href attributes within SVG `

This vulnerability is rated Moderate for Red Hat products. A cross-site scripting (XSS) flaw in the Angular Template Compiler allows an attacker to inject malicious scripts into web pages. This affects several Red Hat products, including Red Hat Enterprise Application Platform, Red Hat JBoss Fuse, Red Hat OpenStack Platform, Red Hat Quay, Red Hat Advanced Cluster Management for Kubernetes, and Red Hat Single Sign-On. Certain components within Red Hat Enterprise Linux and Community Projects are either not affected or will not be fixed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue can be mitigating by avoiding the usage of dynamic bindings, this can be achieved by not using the Angular template binding [attr.href] when handling SVG `