Angular CVE-2025-66412

We need to produce a JSON with all the specified fields. I'll synthesize the data.

First, the product name: "Angular" is the main product. The vulnerability is in Angular Template Compiler. So "Angular" is sufficient as a single product name. But could also say "Angular Framework" but 1-3 words: "Angular" fits.

Summary: Must be original, not paraphrase description. Start with impact verb and product: "Stored Cross-Site Scripting in Angular Template Compiler versions 19.x prior to 19.2.17, 20.x prior to 20.3.15, 21.x prior to 21.0.2, and 18.x and earlier allows..." include that attacker can inject malicious scripts. Mention EPSS low, KEV not mentioned (so not in KEV), but POC? No explicit POC mention, but there is source code evidence, so likely not public exploit. "no public exploit identified at time of analysis". EPSS 0.04% low. Active exploitation? Not in KEV, but source code suggests a fix, and advisory from GitHub. No indication of active exploitation. So summary: "Stored Cross-Site Scripting (XSS) vulnerability in Angular's template compiler allows attackers to inject malicious JavaScript via specific URL-holding attributes and SVG animation elements, bypassing built-in sanitization." I'll craft more specifically.

Technical context: CWE-79, the underlying technology is Angular's template compiler and its security schema for sanitization of attribute bindings. Mention that the compiler's incomplete schema for URL-holding attributes (like xlink:href, math:href) and SVG animation attribute "attributeName" leads to bypassing sanitization. CPE strings show angular for node.js. The commit diff shows changes to validation functions (e.g., replacing validateIframeAttribute with validateAttribute, adding new test cases for SVG animation). So root cause is insufficient classification of attributes as requiring URL security context.

Risk assessment: Use CVSS vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X... So vector: AV:N network,