PT-2026-41887 · Google · Angular

Published 2026-05-19 · Updated 2026-05-19 · CVE-2025-40900

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An Angular template injection occurs in the Reports functionality because of improper validation of an input parameter. An authenticated user with report privileges can create a malicious report with an Angular template payload, or a victim can be tricked into importing a malicious report template. When the report is viewed or imported, the template executes in the browser context, enabling the attacker to modify application data or disrupt application availability. Existing input validation and Content Security Policy (CSP)—a security layer that helps detect and mitigate certain types of attacks—prevent full Cross-Site Scripting (XSS) and direct information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-40900

Affected Products

Angular

References · 3

• https://security.nozominetworks.com/NN-2026:3-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40900 · Security Note
• https://twitter.com/CVEnew/status/2056870231478301047 · Twitter Post