CVE-2026-54265

A flaw was found in Angular's @angular/compiler package. When a native DOM property requiring sanitization is bound using two-way binding syntax, the template compiler fails to apply the appropriate sanitizer. An attacker who controls the bound value can bypass Angular's built-in sanitization, potentially leading to cross-site scripting (XSS).

A flaw was found in Angular's @angular/compiler package. When a native DOM property that requires sanitization (such as innerHTML) is bound using two-way binding syntax (e.g., [(innerHTML)]="value"), the Angular template compiler fails to apply the appropriate sanitizer. This allows an attacker who controls the bound value to bypass Angular's built-in sanitization, potentially leading to cross-site scripting (XSS). This vulnerability only affects Angular 2+ (versions 19.x through 22.x); AngularJS 1.x is a different codebase and is not affected. Red Hat products shipping AngularJS 1.x (such as firefox, grafana, and thunderbird) are not impacted by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.