CVE-2026-27970: Angular i18n Pipeline XSS Vulnerability

CVE-2026-27970 Overview

CVE-2026-27970 is a Cross-Site Scripting (XSS) vulnerability affecting the Angular framework's internationalization (i18n) pipeline. The vulnerability exists in the ICU (International Components for Unicode) message handling, where HTML from translated content is not properly sanitized and can execute arbitrary JavaScript code within the application context.

Angular i18n follows a three-step process: extracting messages from the source application, sending messages to translation partners, and merging translations back into the final source code. If a compromised or malicious translation file is incorporated into an Angular application, the unsanitized content can be rendered and execute attacker-controlled JavaScript in the application's origin.

Critical Impact

Successful exploitation allows execution of attacker-controlled JavaScript within the application origin, potentially leading to credential exfiltration and page vandalism.

Affected Products

• Angular versions prior to 21.2.0
• Angular versions prior to 21.1.16
• Angular versions prior to 20.3.17
• Angular versions prior to 19.2.19

Discovery Timeline

• 2026-02-26 - CVE-2026-27970 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27970

Vulnerability Analysis

The vulnerability resides in Angular's i18n parsing module, specifically in how ICU messages handle HTML content from translation files. The core issue stems from the assumption that input strings from translation files are inherently safe, which allows malicious HTML and JavaScript to bypass sanitization when rendered in the application.

When ICU messages containing HTML elements with sensitive URI attributes are processed, the i18n parser fails to adequately validate and sanitize these attributes before rendering. This creates a pathway for XSS attacks through specially crafted translation content.

Several preconditions must be met for successful exploitation: the attacker must compromise the translation file (XLIFF, XTB, etc.), the victim application must use Angular i18n with ICU messages, the application must render an ICU message, and the application must not have defensive XSS mitigations such as a strict Content Security Policy (CSP).

Root Cause

The root cause is improper input validation in the i18n_parse.ts module within Angular's core rendering engine. The parser assumed that translation input strings were safe unless they contained explicit bindings, failing to properly sanitize HTML content and URI attributes from translation files that could contain malicious payloads.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must first compromise an application's translation file through supply chain manipulation, third-party translation service compromise, or direct file manipulation. Once the malicious translation content is incorporated into the Angular application build process and deployed, any user who renders the affected ICU message will execute the attacker's JavaScript code.

The attack flow involves:

1. Compromising translation files delivered by third-party translation contractors
2. Injecting malicious HTML/JavaScript within ICU message content
3. Having the victim application merge the compromised translations
4. Executing arbitrary JavaScript when end users render the affected pages

// Security patch showing the fix in i18n_parse.ts
// Source: https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d

             const attr = elAttrs.item(i)!;
             const lowerAttrName = attr.name.toLowerCase();
             const hasBinding = !!attr.value.match(BINDING_REGEXP);
-            // we assume the input string is safe, unless it's using a binding
             if (hasBinding) {
               if (VALID_ATTRS.hasOwnProperty(lowerAttrName)) {
                 if (URI_ATTRS[lowerAttrName]) {

The patch removes the dangerous assumption that input strings are safe by default, implementing stricter validation for sensitive URI attributes within ICU messages.

Detection Methods for CVE-2026-27970

Indicators of Compromise

• Unexpected JavaScript execution originating from translated content or i18n message rendering
• Suspicious HTML tags or JavaScript event handlers within translation files (XLIFF, XTB)
• Anomalous network requests to external domains originating from i18n-rendered pages
• Credential exfiltration attempts or session token leakage correlated with page rendering

Detection Strategies

• Implement static analysis scanning of translation files for HTML elements containing JavaScript event handlers or suspicious URI attributes
• Monitor Content Security Policy violation reports for inline script execution attempts
• Deploy runtime XSS detection tools to identify DOM-based script injection during page rendering
• Audit translation file integrity using checksums or digital signatures before build integration

Monitoring Recommendations

• Enable CSP reporting to capture and analyze policy violations in production environments
• Implement logging for translation file modifications and deployments
• Monitor for unusual DOM manipulation patterns during i18n message rendering
• Track third-party translation service access and file delivery integrity

How to Mitigate CVE-2026-27970

Immediate Actions Required

• Upgrade Angular to patched versions: 21.2.0, 21.1.16, 20.3.17, or 19.2.19
• Review and verify all translated content received from untrusted third parties before incorporating into builds
• Enable strict Content Security Policy (CSP) controls to block unauthorized inline JavaScript execution
• Implement Trusted Types to enforce proper HTML sanitization across the application

Patch Information

Angular has released security patches across multiple supported versions. The fixes are available in versions 21.2.0, 21.1.16, 20.3.17, and 19.2.19. The patches address the vulnerability by removing the unsafe assumption about translation input safety and implementing proper validation for sensitive URI attributes in ICU messages.

For detailed patch information, see the GitHub Security Advisory GHSA-prjf-86w9-mfqv and the associated pull request.

Workarounds

• Implement a strict Content Security Policy that prevents inline script execution and restricts script sources
• Enable Trusted Types enforcement to sanitize HTML content before DOM insertion
• Establish a secure review process for translation files, including automated scanning for malicious content
• Consider hosting translation workflows internally rather than relying on external third-party contractors

# Example Content Security Policy configuration for Apache
# Add to .htaccess or httpd.conf

Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';"

# Enable Trusted Types via CSP header
Header append Content-Security-Policy "require-trusted-types-for 'script';"