CVE-2026-69151

A flaw was found in the Angular compiler's internationalization (i18n) pipeline. This vulnerability allows a lower-trust translation file to replace a static event handler with executable JavaScript. A remote attacker could exploit this by injecting malicious scripts, leading to Cross-Site Scripting (XSS). This could result in unauthorized access to sensitive information or actions performed on behalf of the user.

Red Hat has assessed this vulnerability as having an Important severity impact because successful exploitation enables cross-site scripting that can lead to session hijacking and unauthorized user actions within the web application. Although triggering the issue requires application templates to bind event handlers to internationalization attributes and process compromised translation files during compilation, the resulting client-side script execution can compromise user session integrity. Red Hat products distributing pre-compiled web interfaces that do not accept untrusted localization inputs present minimal real-world risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.