CVE-2025-66412
Medium · 5.4CVSS
5.4
EPSS
0.4%
Published
Dec 1, 2025
CISA due date
—
The record
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/compiler | 0 | No fix |
| npm | @angular/compiler | 19.0.0-next.0 | 19.2.17 |
| npm | @angular/compiler | 20.0.0-next.0 | 20.3.15 |
| npm | @angular/compiler | 21.0.0-next.0 | 21.0.2 |
Related vulnerabilities
- GHSA-v4hv-rgfq-gp49 Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes Same vulnerability
- CVE-2026-54265 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- CVE-2026-50557 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- GHSA-58w9-8g37-x9v5 @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS) Also affects @angular/compiler
- GHSA-f3m7-gqxr-g87x Angular: Template and Attribute Namespace Sanitization Bypass (XSS) Also affects @angular/compiler
- CVE-2026-32635 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings Also affects @angular/compiler
- CVE-2026-22610 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler