High-Severity XSS Flaw in Angular i18n Turns Language Files into Backdoors

A high-severity XSS vulnerability (CVE-2026-27970, CVSS ~7.6) in Angular's i18n pipeline allows attackers to hide JavaScript inside ICU translation files; if translation files are compromised and applications lack strong CSP/Trusted Types, attackers can execute code in users' browsers to steal credentials or alter pages. Angular has released patches (21.2.0, 21.1.6, 20.3.17, 19.2.19) and recommends reviewing third-party translations and enforcing strict CSP as interim mitigation.