CVE-2025-66412
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
How to fix
- angular angular19.2.17, 20.3.15, 21.0.2 or later
- @angular/compiler21.0.2, 20.3.15, 19.2.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| angular angular | v ≤ 18.2.14, 19.0.0 ≤ v < 19.2.17, 20.0.0 ≤ v < 20.3.15, 21.0.0 ≤ v < 21.0.2 | 19.2.17, 20.3.15, 21.0.2 |
| @angular/compilernpm | 21.0.0-next.0 ≤ v < 21.0.2, 20.0.0-next.0 ≤ v < 20.3.15, 19.0.0-next.0 ≤ v < 19.2.17, v ≤ 18.2.14 | 21.0.2, 20.3.15, 19.2.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.