CVE-2026-50557

A flaw was found in Angular's @angular/compiler and @angular/core packages. Namespaced script elements were not properly identified by the template preparser, and security context schema mappings did not consistently handle attributes within namespaced elements. An attacker who can inject template structures with custom namespaces can bypass Angular's sanitization logic, potentially leading to cross-site scripting (XSS).

A flaw was found in Angular's @angular/compiler and @angular/core packages. Namespaced script elements (e.g., <svg:script>) were not properly identified as script elements by the Angular template preparser, and security context schema mappings did not consistently handle attributes within namespaced elements. This allows an attacker who can inject template structures to bypass Angular's sanitization logic, potentially leading to cross-site scripting (XSS). This vulnerability only affects Angular 2+ (versions 19.x through 22.x); AngularJS 1.x is a different codebase and is not affected. Red Hat products shipping AngularJS 1.x (such as firefox, grafana, and thunderbird) are not impacted by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.