Executive brief
A security vulnerability in the Angular web framework could allow attackers to execute malicious scripts in a user's browser. This occurs when an application displays untrusted data using specific SVG or MathML features, potentially leading to the theft of login sessions or sensitive user information. To be affected, a user must typically interact with a malicious element or view a specific animation on a page that handles untrusted input.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Angular Template Compiler due to an incomplete internal security schema. The compiler fails to properly sanitize certain URL-holding attributes in SVG and MathML (such as xlink:href) and does not validate the attributeName attribute on SVG animation elements (like <animate>). An attacker can exploit this by binding untrusted data to these attributes, injecting 'javascript:' URLs that bypass Angular's built-in sanitization. Execution occurs when the animation triggers or the user interacts with the element. Patches are available in versions 19.2.17, 20.3.15, and 21.0.2.
Affected products
- Angular @angular/compiler < 19.2.17, >= 20.0.0-next.0, < 20.3.15, >= 21.0.0-next.0, < 21.0.2
Timeline
- 2025-12-01: advisory: NVD publication date
- 2025-12-02: disclosed: GitHub Advisory published