PT-2026-49567 · Google · Angular
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Angular versions prior to 22.0.0-rc.2
Angular versions prior to 21.2.15
Angular versions prior to 20.3.22
Angular versions prior to 19.2.22
Description
An issue in the
@angular/compiler and @angular/core packages allows bypassing element and attribute sanitization and validation through namespace workarounds. The Angular template preparser fails to properly identify namespaced script elements, such as <svg:script> or <:svg:script>, as script elements, allowing them to pass through template compilation without being stripped. Additionally, security context schema mappings for element attributes do not consistently handle attributes within namespaced elements like SVG and MathML, creating gaps where malicious namespaced attributes can bypass runtime and compile-time sanitizers. These flaws enable an attacker to inject a template or tag structure with custom namespaces to bypass script-stripping logic and attribute sanitizers, resulting in client-side Cross-Site Scripting (XSS), which is the execution of arbitrary JavaScript in the user's browser context.Recommendations
Update to version 22.0.0-rc.2.
Update to version 21.2.15.
Update to version 20.3.22.
Update to version 19.2.22.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Angular