GHSA-v4hv-rgfq-gp49
NoneCVSS
—
EPSS
—
Published
Dec 2, 2025
CISA due date
—
The record
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/compiler | 0 | No fix |
| npm | @angular/compiler | 19.0.0-next.0 | 19.2.17 |
| npm | @angular/compiler | 20.0.0-next.0 | 20.3.15 |
| npm | @angular/compiler | 21.0.0-next.0 | 21.0.2 |
Related vulnerabilities
- CVE-2025-66412 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-54265 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- CVE-2026-50557 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- GHSA-58w9-8g37-x9v5 @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS) Also affects @angular/compiler
- GHSA-f3m7-gqxr-g87x Angular: Template and Attribute Namespace Sanitization Bypass (XSS) Also affects @angular/compiler
- CVE-2026-32635 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler
- GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings Also affects @angular/compiler
- CVE-2026-22610 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/compiler