CVE-2025-66412: Angular Compiler Stored XSS Vulnerability via SVG Animation and URL Attributes
Summary
CVE-2025-66412: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes. Affects @angular/compiler across 4 version ranges.
< 18.2.14
>= 19.0.0-next.0, < 19.2.17
>= 20.0.0-next.0, < 20.3.15
>= 21.0.0-next.0, < 21.0.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Angular framework is a widely-used platform for building web applications. It provides a robust set of tools for developing dynamic single-page applications. The Angular Template Compiler is responsible for compiling Angular templates into executable code. However, it has been found to have security vulnerabilities that can lead to stored cross-site scripting (XSS) attacks, particularly through SVG animation and URL attributes.
Vulnerability Detail
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Angular Template Compiler due to an incomplete internal security schema. This flaw allows attackers to bypass Angular's built-in security sanitization, particularly with certain URL-holding attributes and SVG animation elements. Attackers can inject malicious scripts by binding untrusted user-controlled data to vulnerable attributes, leading to potential session hijacking, data exfiltration, and unauthorized actions within the application context.
How To Fix
Latest published version: 22.2.3 as of 23 Oct 2026
npm install @angular/compiler@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 18.2.1418.2.14npm install @angular/compiler@18.2.14 -
>= 19.0.0-next.0, < 19.2.1719.2.17npm install @angular/compiler@19.2.17 -
>= 20.0.0-next.0, < 20.3.1520.3.15npm install @angular/compiler@20.3.15 -
>= 21.0.0-next.0, < 21.0.221.0.2npm install @angular/compiler@21.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not an option, ensure that any data bound to vulnerable attributes is never sourced from untrusted input. Avoid using template bindings like [attr.xlink:href]="maliciousURL" and do not bind untrusted data to the attributeName attribute of SVG animation elements. Additionally, implement a robust Content Security Policy (CSP) to disallow javascript: URLs.
Conclusion
The CVE-2025-66412 vulnerability in the Angular Template Compiler poses significant security risks due to its potential for stored XSS attacks. It is crucial for developers to apply the necessary patches or implement workarounds to mitigate these risks and protect their applications.
See every vulnerability recorded for @angular/compiler →
FAQ
The vulnerability is a Stored XSS flaw that allows attackers to inject malicious scripts through SVG animation and URL attributes.
Attackers can exploit this vulnerability by binding untrusted data to vulnerable attributes, which can lead to arbitrary code execution when users interact with the affected elements.
The impacts include session hijacking, data exfiltration, and unauthorized actions performed on behalf of users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade, ensure that untrusted data is not bound to vulnerable attributes and implement a strong Content Security Policy.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/compiler.
