Overview
CVE-2025-66412 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Angular versions prior to 21.0.2, 20.3.15, and 19.2.17. This vulnerability resides in the Angular Template Compiler and allows attackers to inject malicious scripts into Angular applications due to an incomplete security schema within the compiler.
Technical Details
The root cause of this vulnerability is an incomplete security schema within the Angular Template Compiler. The compiler fails to properly identify certain URL-holding attributes as requiring strict URL security sanitization. This oversight allows attackers to bypass Angular’s built-in security mechanisms by injecting malicious scripts through attributes that could potentially contain `javascript:` URLs or other unsafe content. Because the Angular compiler isn’t properly sanitizing these attributes, injected code can be executed in the user’s browser.
This means that if an attacker can control data that is bound to a vulnerable attribute in an Angular template, they can inject arbitrary JavaScript code. This code will then execute in the context of the user viewing the page, potentially allowing the attacker to steal cookies, redirect the user to a malicious website, or perform other malicious actions.
CVSS Analysis
Due to the wide range of potential impacts, a CVSS score is generally highly rated. However, in this particular case, CVSS score and Severity were not published at the time of disclosure. Users are advised to upgrade as soon as possible regardless of the specific CVSS score.
Possible Impact
The successful exploitation of CVE-2025-66412 can have severe consequences, including:
- Account Takeover: Attackers can steal user credentials and gain unauthorized access to user accounts.
- Data Theft: Sensitive data, such as personal information or financial details, can be stolen.
- Website Defacement: Attackers can modify the appearance of the website, damaging its reputation.
- Malware Distribution: Attackers can inject malicious code that redirects users to websites hosting malware.
Mitigation and Patch Steps
The most effective way to mitigate this vulnerability is to upgrade your Angular application to one of the following versions or later:
- Angular 21.0.2
- Angular 20.3.15
- Angular 19.2.17
To upgrade, use the Angular CLI:
ng update @angular/core@latest @angular/cli@latestAlways test your application thoroughly after upgrading to ensure compatibility and prevent regressions.
