[deps]: Update @angular/core to v21.2.20 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/core (source)	21.2.17 → 21.2.20

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

CVE-2026-69151 / GHSA-jj27-h5hq-8x99

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).

When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.

The following example illustrates a vulnerable pattern:

<img src="foo.jpg" onerror="void 0" i18n-onerror />

Impact

When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to:

• Session Hijacking: Accessing session cookies, tokens, or sensitive user data.
• Unauthorized Actions: Performing actions on behalf of the authenticated user.

Patched Versions

• 22.0.1
• 21.2.19
• 20.3.27

Workarounds

Ensure that static event-handler attributes (e.g., onerror, onclick) are never marked for internationalization (i18n-on*) in application templates, and ensure translation files are sourced from trusted origins.

Severity

• CVSS Score: 7.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99
• https://github.com/angular/angular/pull/68821
• https://github.com/angular/angular/pull/69306
• https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e
• https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865
• https://github.com/advisories/GHSA-jj27-h5hq-8x99

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler

CVE-2026-88057 / GHSA-hh8m-fm6v-7cvg

More information

Details

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS).

Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.

When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:

• hostDirectives composition,
• Class inheritance of host bindings,
• Dynamic component instantiation (createComponent with custom hostElement or dynamic directives),
• Elements with SVG/MathML namespaces (e.g. <svg:a>, <math>), or
• Elements using tag-neutral selectors (e.g. :not(...)),

the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. javascript:... URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.

Impact

An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).

Patches

This issue has been resolved in versions:

• 22.1.0
• 21.2.20
• 20.3.28

Workarounds

Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict the input to validated safe URL schemes (e.g. http://, https://).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg
• https://github.com/angular/angular/issues/69550
• https://github.com/angular/angular/pull/69558
• https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264
• https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee
• https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b
• https://github.com/angular/angular/releases/tag/v20.3.28
• https://github.com/angular/angular/releases/tag/v21.2.20
• https://github.com/angular/angular/releases/tag/v22.1.0
• https://github.com/advisories/GHSA-hh8m-fm6v-7cvg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/core)

v21.2.20

Compare Source

core

Commit	Type	Description
6afe6fa781	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

v21.2.19

Compare Source

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

v21.2.18

Compare Source

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: ui/package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @bitwarden/splunk-ui@1.0.0
npm error Found: @angular/core@21.2.20
npm error node_modules/@angular/core
npm error   @angular/core@"21.2.20" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/core@"21.2.17" from @angular/animations@21.2.17
npm error node_modules/@angular/animations
npm error   @angular/animations@"21.2.17" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-13T13_49_41_977Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-13T13_49_41_977Z-debug-0.log