CVE-2025-66412: Google Angular Stored XSS in Template Compiler via SVG and MathML

CVE-2025-66412 · Severity: high · CVSS 5.4 · Published 2025-12-01

A security vulnerability in the Angular web framework could allow attackers to execute malicious scripts in a user's browser. This occurs when an application displays untrusted data using specific SVG or MathML features, potentially leading to the theft of login sessions or sensitive user information. To be affected, a user must typically interact with a malicious element or view a specific animation on a page that handles untrusted input.

Technologies: Google Compiler, @angular/compiler (npm). Vendors: Google, npm.

Quick answers

Is CVE-2025-66412 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-66412 being exploited in the wild.
How severe is CVE-2025-66412?
High severity, with a CVSS score of 5.4, published 1 December 2025.
Which products and versions are affected?
Google Compiler < 19.2.17, >= 20.0.0-next.0, < 20.3.15, >= 21.0.0-next.0, < 21.0.2; @angular/compiler (npm) SEMVER:introduced=21.0.0-next.0,fixed=21.0.2.
Is there a fix for CVE-2025-66412?
Yes. @angular/compiler (npm): upgrade to 21.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66412 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-66412?
Check whether you run Google Compiler or @angular/compiler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/compiler (npm): upgrade to 21.0.2 or later
    npm install @angular/compiler@21.0.2

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Angular Template Compiler due to an incomplete internal security schema. The compiler fails to properly sanitize certain URL-holding attributes in SVG and MathML (such as xlink:href) and does not validate the attributeName attribute on SVG animation elements (like <animate>). An attacker can exploit this by binding untrusted data to these attributes, injecting 'javascript:' URLs that bypass Angular's built-in sanitization. Execution occurs when the animation triggers or the user interacts with the element. Patches are available in versions 19.2.17, 20.3.15, and 21.0.2.

Affected products

  • Angular @angular/compiler < 19.2.17, >= 20.0.0-next.0, < 20.3.15, >= 21.0.0-next.0, < 21.0.2

Identifiers

  • CVE-2025-66412
  • GHSA-v4hv-rgfq-gp49

Timeline

  • 2025-12-01: advisory: NVD publication date
  • 2025-12-02: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.