Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-66412: Angular templates can let attackers inject scripts

CVE-2025-66412 · published 11 months ago

Summary

Versions of Angular before the latest updates let specially crafted SVG or MathML content bypass built-in cleaning, so a malicious user could store harmful code that runs in other users' browsers. This could lead to data theft or unwanted actions on your site. Update Angular to the newest release to close the gap.

What to do

Update angular compiler to version 21.0.2.
Update angular compiler to version 20.3.15.
Update angular compiler to version 19.2.17.
Update angular @angular/compiler to version 21.0.2.
Update angular @angular/compiler to version 20.3.15.
Update angular @angular/compiler to version 19.2.17.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	angular	angular	<= 18.2.14 >= 19.0.0, < 19.2.17 >= 20.0.0, < 20.3.15 >= 21.0.0, < 21.0.2 `cpe:2.3:a:angular:angular::::::node.js::*`
npm	angular	compiler	>= 21.0.0-next.0, < 21.0.2 >= 20.0.0-next.0, < 20.3.15 >= 19.0.0-next.0, < 19.2.17 <= 18.2.14 Fix: upgrade to 21.0.2
npm	angular	@angular/compiler	>= 21.0.0-next.0, < 21.0.2 >= 20.0.0-next.0, < 20.3.15 >= 19.0.0-next.0, < 19.2.17 <= 18.2.14 Fix: upgrade to 21.0.2
Ubuntu:Pro:16.04:LTS	canonical	angular.js	All versions

Original advisory text

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.

References

https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc489... Patch
https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49 Vendor Advisory
https://github.com/advisories/GHSA-v4hv-rgfq-gp49
https://nvd.nist.gov/vuln/detail/CVE-2025-66412 Vendor Advisory
https://github.com/angular/angular Product
https://ubuntu.com/security/CVE-2025-66412 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-66412 Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-253495.html URL
https://cert-portal.siemens.com/productcert/html/ssa-485750.html URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66412... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published1 Dec 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-66412 · NVD

GHSA-v4hv-rgfq-gp49 · GHSA

GHSA-v4hv-rgfq-gp49 · OSV

UBUNTU-CVE-2025-66412 · OSV

CVE-2025-66412 · OSV

Track software like this

Free during beta