PT-2025-48196 · Google · Angular

Published 2025-11-26 · Updated 2026-02-13 · CVE-2025-66035

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Angular versions prior to 19.2.16 Angular versions prior to 20.3.14 Angular versions prior to 21.0.1

Description Angular’s HttpClient has a built-in Cross-Site Request Forgery (XSRF) protection mechanism. When handling requests with protocol-relative URLs (URLs starting with '//'), the system incorrectly treats them as same-origin requests. This results in the automatic addition of the XSRF token to the X-XSRF-TOKEN header, leading to unauthorized disclosure of the token to an attacker-controlled domain. This is a credential leak caused by application logic.

Recommendations Angular versions prior to 19.2.16: Update to version 19.2.16 or later. Angular versions prior to 20.3.14: Update to version 20.3.14 or later. Angular versions prior to 21.0.1: Update to version 21.0.1 or later. Avoid using protocol-relative URLs (URLs starting with '//') in HttpClient requests. Use hardcoded relative paths (starting with a single '/') or fully qualified, trusted absolute URLs for all backend communication.

Exploit

Fix

Weakness Enumeration

CWE-201

CWE-359

Related Identifiers

CVE-2025-66035

GHSA-58C5-G7WP-6W37

Affected Products

Angular

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66035.json · Exploit
• https://cve.org/CVERecord?id=CVE-2025-66035 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66035 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66035 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66035 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66035 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66035 · Vendor Advisory
• https://github.com/angular/angular/releases/tag/20.3.14 · Note
• https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f · Note
• https://github.com/angular/angular/releases/tag/19.2.16 · Note
• https://github.com/angular/angular/releases/tag/21.0.1 · Note
• https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37 · Note
• https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e · Note
• https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc · Note