PT-2025-48578 · Google · Angular

Published 2025-12-01 · Updated 2026-02-20 · CVE-2025-66412

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Angular versions prior to 21.0.2 Angular versions prior to 20.3.15 Angular versions prior to 19.2.17

Description A Stored Cross-Site Scripting (XSS) issue exists in the Angular Template Compiler due to an incomplete internal security schema. This allows attackers to bypass Angular’s built-in security sanitization by injecting malicious scripts through URL-holding attributes that are not classified as requiring strict URL security. These attributes can contain javascript: URLs.

Recommendations Update to Angular version 21.0.2 or later. Update to Angular version 20.3.15 or later. Update to Angular version 19.2.17 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-15561

CVE-2025-66412

GHSA-V4HV-RGFQ-GP49

Affected Products

Angular

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66412.json · Exploit
• https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66412 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66412 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66412 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-66412 · Security Note
• https://ubuntu.com/security/CVE-2025-66412 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66412 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15561 · Security Note
• https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49 · Note
• https://reddit.com/r/angular/comments/1pd8kh0/why_the_spike_in_angular_cves_this_year · Reddit Post
• https://twitter.com/dailytechonx/status/1996644448139166074 · Twitter Post
• https://twitter.com/devgenius1/status/2003801779746566231 · Twitter Post
• https://t.me/cveNotify/152602 · Telegram Post