compiler-15.2.2.tgz: 4 vulnerabilities (highest severity is: 8.0)

[mend-bolt-for-github]

Vulnerable Library - compiler-15.2.2.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-15.2.2.tgz

Path to dependency file: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/@⁠angular/compiler/package.json

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (compiler version)	Remediation Possible**
CVE-2026-22610	High	8.0	compiler-15.2.2.tgz	Direct	angular - 20.3.16,angular - 21.0.7,angular - 19.2.18,https://github.com/angular/angular.git - v19.2.18,https://github.com/angular/angular.git - v20.3.16,https://github.com/angular/angular.git - v21.1.0-rc.0,https://github.com/angular/angular.git - v21.0.7	❌
CVE-2025-66412	High	8.0	compiler-15.2.2.tgz	Direct	https://github.com/angular/angular.git - 21.0.2,https://github.com/angular/angular.git - 19.2.17,https://github.com/angular/angular.git - 20.3.15	❌
CVE-2026-54265	Medium	5.4	compiler-15.2.2.tgz	Direct	https://github.com/angular/angular.git - v20.3.25,https://github.com/angular/angular.git - v21.2.17	❌
CVE-2026-50557	Medium	5.4	compiler-15.2.2.tgz	Direct	https://github.com/angular/angular.git - v21.2.15,https://github.com/angular/angular.git - v20.3.22,https://github.com/angular/angular.git - v19.2.22	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-22610

Vulnerable Library - compiler-15.2.2.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-15.2.2.tgz

Path to dependency file: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/@⁠angular/compiler/package.json

Dependency Hierarchy:

• ❌ compiler-15.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Found in base branch: main

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

Publish Date: 2026-01-10

URL: CVE-2026-22610

CVSS 3 Score Details (8.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jrmj-c5cx-3cw6

Release Date: 2026-01-10

Fix Resolution: angular - 20.3.16,angular - 21.0.7,angular - 19.2.18,https://github.com/angular/angular.git - v19.2.18,https://github.com/angular/angular.git - v20.3.16,https://github.com/angular/angular.git - v21.1.0-rc.0,https://github.com/angular/angular.git - v21.0.7

Step up your Open Source Security Game with Mend here

CVE-2025-66412

Vulnerable Library - compiler-15.2.2.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-15.2.2.tgz

Path to dependency file: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/@⁠angular/compiler/package.json

Dependency Hierarchy:

• ❌ compiler-15.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Found in base branch: main

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.

Publish Date: 2025-12-01

URL: CVE-2025-66412

CVSS 3 Score Details (8.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-12-01

Fix Resolution: https://github.com/angular/angular.git - 21.0.2,https://github.com/angular/angular.git - 19.2.17,https://github.com/angular/angular.git - 20.3.15

Step up your Open Source Security Game with Mend here

CVE-2026-54265

Vulnerable Library - compiler-15.2.2.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-15.2.2.tgz

Path to dependency file: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/@⁠angular/compiler/package.json

Dependency Hierarchy:

• ❌ compiler-15.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Found in base branch: main

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @⁠angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Publish Date: 2026-06-22

URL: CVE-2026-54265

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-58w9-8g37-x9v5

Release Date: 2026-06-15

Fix Resolution: https://github.com/angular/angular.git - v20.3.25,https://github.com/angular/angular.git - v21.2.17

Step up your Open Source Security Game with Mend here

CVE-2026-50557

Vulnerable Library - compiler-15.2.2.tgz

Angular - the compiler library

Library home page: https://registry.npmjs.org/@⁠angular/compiler/-/compiler-15.2.2.tgz

Path to dependency file: /MangoAPI.Client/package.json

Path to vulnerable library: /MangoAPI.Client/node_modules/@⁠angular/compiler/package.json

Dependency Hierarchy:

• ❌ compiler-15.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 0c9bb5bd04415d4d387e12646c7ce749fd8ffae2

Found in base branch: main

Vulnerability Details

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @⁠angular/compiler and @⁠angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., "svg:script" (svg:script) or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-06-22

URL: CVE-2026-50557

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f3m7-gqxr-g87x

Release Date: 2026-06-15

Fix Resolution: https://github.com/angular/angular.git - v21.2.15,https://github.com/angular/angular.git - v20.3.22,https://github.com/angular/angular.git - v19.2.22

Step up your Open Source Security Game with Mend here