Stored Cross-Site Scripting Vulnerability in Angular Framework
CVE-2025-66412

8.5HIGH

Key Information:

Vendor

Angular

Status
Angular
Vendor
CVE Published:
1 December 2025

What is CVE-2025-66412?

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Angular Template Compiler, prior to versions 21.0.2, 20.3.15, and 19.2.17. This flaw is due to the compiler's internal security schema being incomplete, permitting attackers to circumvent Angular's security sanitization measures. Specifically, the issue arises from insufficient classification of certain URL-holding attributes, allowing for the injection of malicious scripts through javascript: URLs. This vulnerability underscores the importance of updating to the latest Angular versions to ensure enhanced security.

Affected Version(s)

angular >= 21.0.0-next.0 < 21.0.2 < 21.0.0-next.0 21.0.2

angular >= 20.0.0-next.0 < 20.3.15 < 20.0.0-next.0 20.3.15

angular >= 19.0.0-next.0 < 19.2.17 < 19.0.0-next.0 19.2.17

References

https://github.com/angular/angular/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/angular/angular/commit/1c6b0704fb63d05...
x_refsource_MISC

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.