XSS in Angular
CVE-2025-66412
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (31.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Angular — versions >= 21.0.0-next.0 < 21.0.2, >= 20.0.0-next.0 < 20.3.15, >= 19.0.0-next.0 < 19.2.17
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Frequently asked questions
- What is CVE-2025-66412?
- CVE-2025-66412 is a medium-severity vulnerability in Angular, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-12-01.
- How severe is CVE-2025-66412?
- Medium severity. CVSS v3 base score is 5.4 out of 10.