PT-2025-48196 · Google · Angular

Published 2025-11-26 · Updated 2025-11-29 · CVE-2025-66035

Positive Technologies · (AI Summary)

CVSS v4.0

7.7

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Angular versions prior to 19.2.16 Angular versions prior to 20.3.14 Angular versions prior to 21.0.1

Description Angular’s HttpClient has a built-in Cross-Site Request Forgery (XSRF) protection mechanism. When handling requests with protocol-relative URLs (URLs starting with '//'), the system incorrectly treats them as same-origin requests. This results in the automatic addition of the XSRF token to the

X-XSRF-TOKEN

header, leading to unauthorized disclosure of the token to an attacker-controlled domain. This is a credential leak caused by application logic.

Recommendations Angular versions prior to 19.2.16: Update to version 19.2.16 or later. Angular versions prior to 20.3.14: Update to version 20.3.14 or later. Angular versions prior to 21.0.1: Update to version 21.0.1 or later. Avoid using protocol-relative URLs (URLs starting with '//') in HttpClient requests. Use hardcoded relative paths (starting with a single '/') or fully qualified, trusted absolute URLs for all backend communication.

Fix

Weakness Enumeration

CWE-359

CWE-201

Related Identifiers

CVE-2025-66035

Affected Products

Angular

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2025-66035 · Security Note
• https://github.com/angular/angular/releases/tag/21.0.1 · Note
• https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f · Note
• https://github.com/angular/angular/releases/tag/19.2.16 · Note
• https://github.com/angular/angular/releases/tag/20.3.14 · Note
• https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37 · Note
• https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e · Note
• https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc · Note
• https://t.me/CVEtracker/38344 · Telegram Post
• https://t.me/pentestingnews/71258 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1p8bkgw/resumen_diario_de_vulnerabilidades_27112025 · Reddit Post
• https://twitter.com/Karma_X_Inc/status/1993941216304521355 · Twitter Post
• https://twitter.com/CVEnew/status/1993814645715460098 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p8bkku/resumen_diario_de_vulnerabilidades_27112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p9dokj/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post