fix(deps, frontend): update dependency @angular/core to v21.2.20

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/core (source)	21.2.19 → 21.2.20

---

Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler

CVE-2026-88057 / GHSA-hh8m-fm6v-7cvg

More information

Details

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS).

Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.

When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:

• hostDirectives composition,
• Class inheritance of host bindings,
• Dynamic component instantiation (createComponent with custom hostElement or dynamic directives),
• Elements with SVG/MathML namespaces (e.g. <svg:a>, <math>), or
• Elements using tag-neutral selectors (e.g. :not(...)),

the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. javascript:... URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.

Impact

An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).

Patches

This issue has been resolved in versions:

• 22.1.0
• 21.2.20
• 20.3.28

Workarounds

Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict the input to validated safe URL schemes (e.g. http://, https://).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg
• https://github.com/angular/angular/issues/69550
• https://github.com/angular/angular/pull/69558
• https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264
• https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee
• https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b
• https://github.com/angular/angular/releases/tag/v20.3.28
• https://github.com/angular/angular/releases/tag/v21.2.20
• https://github.com/angular/angular/releases/tag/v22.1.0
• https://github.com/advisories/GHSA-hh8m-fm6v-7cvg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler

CVE-2026-88057 / GHSA-hh8m-fm6v-7cvg

More information

Details

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS).

Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.

When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:

• hostDirectives composition,
• Class inheritance of host bindings,
• Dynamic component instantiation (createComponent with custom hostElement or dynamic directives),
• Elements with SVG/MathML namespaces (e.g. <svg:a>, <math>), or
• Elements using tag-neutral selectors (e.g. :not(...)),

the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. javascript:... URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.

Impact

An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).

Patches

This issue has been resolved in versions:

• 22.1.0
• 21.2.20
• 20.3.28

Workarounds

Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict the input to validated safe URL schemes (e.g. http://, https://).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg
• https://github.com/angular/angular/issues/69550
• https://github.com/angular/angular/pull/69558
• https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264
• https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee
• https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b
• https://github.com/angular/angular
• https://github.com/angular/angular/releases/tag/v20.3.28
• https://github.com/angular/angular/releases/tag/v21.2.20
• https://github.com/angular/angular/releases/tag/v22.1.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/core)

v21.2.20

Compare Source

core

Commit	Type	Description
6afe6fa781	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Backport auto-label report

This fix: PR was checked against each actively-supported release branch. A release/* label nominates a backport target; the branch's release manager approving this PR is what sends the fix there. The required Backport Approvals check stays red until every label below is approved, so each manager either approves or removes their own label — which is why the labels left on a merged PR are exactly the branches it reached.

Release branch	Analysis
✅ release/v1.3	Change detected on this branch — label added; this fix is queued to backport here. @mengw15 decides: approving sends the fix here, removing this label declines it. The merge waits on one or the other. Review requested.
✅ release/v1.2	Already labeled — this fix is queued to backport here. @xuang7 decides: approving sends the fix here, removing this label declines it. The merge waits on one or the other.

Auto-label run.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @mengw15
  You can notify them by mentioning @mengw15 in a comment.

[codecov-commenter]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.