CVE-2025-66412 Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
Attackers can inject malicious scripts via SVG or MathML attributes due to incomplete security schema, leading to stored XSS in Angular applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-66412?
CVE-2025-66412 is a high-severity cross-site scripting vulnerability in angular, published on 1 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
Weakness: CWE-79
Which versions are affected by CVE-2025-66412?
8 open source packages ship an affected version, including @angular/compiler. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@angular/compiler npm | All versions to 18.2.14 | None |
@angular/compiler npm | All versions to 18.2.14 | None |
@angular/compiler npm | From 19.0.0-next.0 | 19.2.17 |
@angular/compiler npm | From 19.0.0-next.0 | 19.2.17 |
@angular/compiler npm | From 20.0.0-next.0 | 20.3.15 |
@angular/compiler npm | From 20.0.0-next.0 | 20.3.15 |
2 more packages
@angular/compiler npm | From 21.0.0-next.0 | 21.0.2 |
@angular/compiler npm | From 21.0.0-next.0 | 21.0.2 |
Products include Angular Angular.
How do I fix CVE-2025-66412?
Upgrade @angular/compiler to a fixed version for your release line: 19.2.17, 20.3.15 or 21.0.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-66412 being exploited?
There is no known exploitation of CVE-2025-66412 in the wild and no public exploit code.
Other vulnerabilities in angular
- CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
- CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
- CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-41423 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Sources
Also known as CLSA-2026-1775176150, CLSA-2026-1775176152, CLSA-2026-1775176157, CLSA-2026-1775176159, CLSA-2026-1775176161, CLSA-2026-1775176163 and 435 more.