EUVD-2025-200118
GHSA-v4hv-rgfq-gp49
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker must store malicious data (PR:L), victim must interact or view the page (UI:R), XSS achieves scope change enabling session hijack on victim browser (S:C); no availability impact described.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
8DescriptionGitHub Advisory
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
AnalysisAI
Stored XSS in the Angular Template Compiler (npm package @angular/compiler) allows an authenticated attacker who can persist data in an Angular application to inject javascript: URLs via SVG attributes (xlink:href), MathML attributes (math|href, annotation|href), and SVG animation element attributeName bindings, bypassing Angular's built-in sanitization entirely. The compiler's internal security schema omitted these attribute families from its strict-URL-security classification, meaning no sanitizer was applied at compile time when developers used template bindings like [attr.xlink:href] or [attr.attributeName] with untrusted data. Upon victim interaction or animation auto-fire, injected JavaScript executes in the application's origin context, enabling session hijacking and data exfiltration. No public exploit code identified at time of analysis; EPSS is 0.04%.
Technical ContextAI
Angular's Template Compiler (cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*) uses an internal compile-time security schema to determine which HTML, SVG, and MathML attributes must be passed through sanitization functions before being set at runtime. The schema categorizes attributes into contexts: HTML (sanitizeHtml), ResourceURL (sanitizeResourceUrl), Style (sanitizeStyle), URL (sanitizeUrl), and None (trusted). The bug (CWE-79) is a schema omission: SVG attributes that can hold javascript: URLs (xlink:href and equivalents), MathML anchor attributes (math|href, annotation|href), and the SVG animation attributeName attribute were all classified as None, bypassing sanitization. The commit diff shows the fix adds an UNSAFE_ATTRIBUTE_BINDING runtime error code, switches iframe attribute validation from validateIframeAttribute to a broader validateAttribute, and applies validateAttribute to animateMotion/animate/set/animateTransform attributeName bindings. The SVG animation vector is particularly subtle: attributeName='href' plus values='javascript:...' redirects an animation to write a javascript: URL into a sibling element's href, sidestepping any per-attribute checks on the target element.
RemediationAI
Upgrade to the fixed Angular releases: 19.2.17, 20.3.15, or 21.0.2, available via npm. The GitHub Security Advisory GHSA-v4hv-rgfq-gp49 and the patch commit (github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a) serve as the authoritative references. Angular 18.x and earlier have no upstream patch; operators on those versions should contact HeroDevs (herodevs.com/vulnerability-directory/cve-2025-66412), which provides commercial long-term support for Angular end-of-life branches. As a compensating control until patching, audit all Angular templates for bindings to xlink:href, math|href, annotation|href, and SVG animation attributeName/values attributes and either remove those bindings or apply Angular's DomSanitizer.bypassSecurityTrustUrl only after manual server-side validation - note that bypassSecurityTrustUrl disables Angular's sanitization entirely for that value and must be used with caution. Siemens customers should consult SSA-253495 and SSA-485750 for product-specific guidance.
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hiera
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| questing | needs-triage | - |
| upstream | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 1.8.2-2 | - |
| bullseye (security) | fixed | 1.8.3-1+deb12u1~deb11u1 | - |
| bookworm | fixed | 1.8.3-1+deb12u1 | - |
| forky, sid, trixie | fixed | 1.8.3-3 | - |
| (unstable) | not-affected | - | - |
Share
External POC / Exploit Code
Leaving vuln.today