Angular is part of Google Open Source Software Vulnerability Reward Program. For vulnerabilities in Angular, please submit your report here.
For more information, check out Angular's security policy.
Security: angular/angular
Security
SECURITY.md
-
Cross-Site Scripting (XSS) in Angular i18nGHSA-prjf-86w9-mfqv published
Feb 25, 2026 by alan-agius4High -
XSS Vulnerability via Unsanitized SVG Script AttributesGHSA-jrmj-c5cx-3cw6 published
Jan 8, 2026 by alan-agius4High -
Stored XSS Vulnerability via SVG Animation, SVG URL and MathML AttributesGHSA-v4hv-rgfq-gp49 published
Dec 1, 2025 by alan-agius4High -
XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP ClientGHSA-58c5-g7wp-6w37 published
Nov 26, 2025 by alan-agius4High -
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageGHSA-68x2-mx4q-78m7 published
Sep 10, 2025 by hybristHigh
Learn more about advisories related to angular/angular in the GitHub Advisory Database