Is @angular/core 20.1 vulnerable?
npm · 9 releases from 20.1.0 to 20.1.8 · latest @angular/core is 22.2.4 · checked 2 Nov 2026
Yes: 8 known advisories
Yes. @angular/core 20.1.8, the last 20.1 release, is affected by 8 known security advisories (5 high, 3 medium), including CVE-2026-69151, CVE-2026-54267, CVE-2026-32635. Upgrade to 20.3.28 or later to fix all of them.
npm install @angular/core@20.3.28Advisories affecting @angular/core 20.1.8
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
- Affected
- >=22.0.0 <22.1.0 · >=21.0.0 <21.2.20 · >=20.0.0 <20.3.28 · <=19.2.25
- Fixed in
- 20.3.28, 21.2.20, 22.1.0
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.19 · >=20.0.0-next.0 <20.3.27 · <=19.2.25
- Fixed in
- 20.3.27, 21.2.19, 22.0.1
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
- Affected
- >=21.0.0-next.0 <21.2.15 · >=22.0.0-next.0 <22.0.0-rc.2 · >=20.0.0-next.0 <20.3.22 · >=19.0.0-next.0 <19.2.22 · <=18.2.14
- Fixed in
- 19.2.22, 20.3.22, 21.2.15, 22.0.0-rc.2
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
- Affected
- >=21.0.0-next.0 <21.2.15 · >=22.0.0-next.0 <22.0.0-rc.2 · >=19.0.0-next.0 <19.2.23 · <=18.2.14 · >=20.0.0-next.0 <20.3.22
- Fixed in
- 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
- Affected
- >=22.0.0-next.0 <22.0.1 · >=21.0.0-next.0 <21.2.17 · >=20.0.0-next.0 <20.3.25 · <=19.2.25
- Fixed in
- 20.3.25, 21.2.17, 22.0.1
Angular vulnerable to XSS in i18n attribute bindings
- Affected
- >=22.0.0-next.0 <22.0.0-next.3 · >=21.0.0-next.0 <21.2.4 · >=20.0.0-next.0.0.0 <20.3.18 · >=19.0.0-next.0 <19.2.20 · >=17.0.0-next.0 <=18.2.14
- Fixed in
- 19.2.20, 20.3.18, 21.2.4, 22.0.0-next.3
Angular i18n vulnerable to Cross-Site Scripting
- Affected
- >=21.2.0-next.0 <21.2.0 · >=21.0.0-next.0 <21.1.6 · >=20.0.0-next.0 <20.3.17 · >=19.0.0-next.0 <19.2.19 · <=18.2.14
- Fixed in
- 19.2.19, 20.3.17, 21.1.6, 21.2.0
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
- Affected
- >=21.1.0-next.0 <21.1.0-rc.0 · >=21.0.0-next.0 <21.0.7 · >=20.0.0-next.0 <20.3.16 · >=19.0.0-next.0 <19.2.18 · <=18.2.14
- Fixed in
- 19.2.18, 20.3.16, 21.0.7, 21.1.0-rc.0
Which of your client projects are still on @angular/core 20.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @angular/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @angular/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.