# CVE-2025-66412: Google Angular Stored XSS in Template Compiler via SVG and MathML

Source: https://junglewise.ai/threats/cve-2025-66412-google-angular-stored-xss-in-template-compiler-via-svg-and-mathml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-66412 · Severity: high · CVSS 5.4 · Published 2025-12-01

A security vulnerability in the Angular web framework could allow attackers to execute malicious scripts in a user's browser. This occurs when an application displays untrusted data using specific SVG or MathML features, potentially leading to the theft of login sessions or sensitive user information. To be affected, a user must typically interact with a malicious element or view a specific animation on a page that handles untrusted input.

Technologies: [Google Compiler](https://junglewise.ai/threats/technologies/compiler), [@angular/compiler (npm)](https://junglewise.ai/threats/technologies/angular-compiler). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-66412 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66412 being exploited in the wild.

**How severe is CVE-2025-66412?** High severity, with a CVSS score of 5.4, published 1 December 2025.

**Which products and versions are affected?** Google Compiler < 19.2.17, >= 20.0.0-next.0, < 20.3.15, >= 21.0.0-next.0, < 21.0.2; @angular/compiler (npm) SEMVER:introduced=21.0.0-next.0,fixed=21.0.2.

**Is there a fix for CVE-2025-66412?** Yes. @angular/compiler (npm): upgrade to 21.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66412 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-66412?** Check whether you run Google Compiler or @angular/compiler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/compiler (npm): upgrade to 21.0.2 or later

  ```sh
  npm install @angular/compiler@21.0.2
  ```


## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Angular Template Compiler due to an incomplete internal security schema. The compiler fails to properly sanitize certain URL-holding attributes in SVG and MathML (such as xlink:href) and does not validate the attributeName attribute on SVG animation elements (like <animate>). An attacker can exploit this by binding untrusted data to these attributes, injecting 'javascript:' URLs that bypass Angular's built-in sanitization. Execution occurs when the animation triggers or the user interacts with the element. Patches are available in versions 19.2.17, 20.3.15, and 21.0.2.

## Affected products

- Angular @angular/compiler < 19.2.17, >= 20.0.0-next.0, < 20.3.15, >= 21.0.0-next.0, < 21.0.2

## Identifiers

- CVE-2025-66412
- GHSA-v4hv-rgfq-gp49

## Timeline

- 2025-12-01: advisory: NVD publication date
- 2025-12-02: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/alan-agius4](https://api.github.com/users/alan-agius4)
- [https://github.com/alan-agius4](https://github.com/alan-agius4)
- [https://api.github.com/users/alan-agius4/gists%7B/gist_id%7D](https://api.github.com/users/alan-agius4/gists%7B/gist_id%7D)
- [https://api.github.com/users/alan-agius4/repos](https://api.github.com/users/alan-agius4/repos)
- [https://avatars.githubusercontent.com/u/17563226?v=4](https://avatars.githubusercontent.com/u/17563226?v=4)
- [https://api.github.com/users/alan-agius4/events%7B/privacy%7D](https://api.github.com/users/alan-agius4/events%7B/privacy%7D)

## Related threats

- [Angular sanitization bypass in directive host bindings](https://junglewise.ai/threats/cve-2026-88057-angular-sanitization-bypass-in-directive-host-bindings)
- [Angular i18n Cross-Site Scripting via event-handler attributes](https://junglewise.ai/threats/cve-2026-69151-angular-i18n-cross-site-scripting-via-event-handler-attributes)
- [Google Angular XSS via two-way property binding bypass in @angular/compiler](https://junglewise.ai/threats/cve-2026-54265-google-angular-xss-via-two-way-property-binding-bypass-in-angular)
- [Google Angular XSS bypass via namespaced elements and attributes](https://junglewise.ai/threats/cve-2026-50557-google-angular-xss-bypass-via-namespaced-elements-and-attributes)
- [Angular XSS in i18n attribute bindings](https://junglewise.ai/threats/cve-2026-32635-angular-xss-in-i18n-attribute-bindings)