- Description
- Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
- Source
- security-advisories@github.com
- NVD status
- Modified
- Products
- angular
CVSS 4.0
- Type
- Secondary
- Base score
- 8.5
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
CVSS 3.1
- Type
- Primary
- Base score
- 5.4
- Impact score
- 2.7
- Exploitability score
- 2.3
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
- security-advisories@github.com
- CWE-79
- Hype score
- Not currently trending
#VulnerabilityReport #Angular High-Severity Angular Flaw (CVE-2025-66412) Allows Stored XSS via SVG and MathML Bypass https://t.co/V7PjEsjRyV
@Komodosec
7 Jan 2026
38 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
⚠️ Developers & Security Teams — Heads Up! CVE-2025-66412 has exposed a major gap in Angular’s template compiler. Full Story: https://t.co/oHsU2ZNXhI https://t.co/BmEfKBJHuJ
@CSec88
3 Dec 2025
56 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-66412 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2… https://t.co/xBnTGg8Jcx
@CVEnew
1 Dec 2025
219 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "B0857B9D-DDD4-42CC-B026-AF3B4081BD14",
"versionEndIncluding": "18.2.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "510711AC-A2E0-42FA-9A67-B77FC0C7FE2A",
"versionEndExcluding": "19.2.17",
"versionStartIncluding": "19.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "ADEEF44B-4624-444D-867A-D75B192FC413",
"versionEndExcluding": "20.3.15",
"versionStartIncluding": "20.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "4D7E1957-7450-48AA-8EEB-62D60EE9DABE",
"versionEndExcluding": "21.0.2",
"versionStartIncluding": "21.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]