8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66412

CVE-2025-66412: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66412

CVE-2025-66412:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/compiler	npm	>= 21.0.0-next.0, < 21.0.2	21.0.2
@angular/compiler	npm	>= 20.0.0-next.0, < 20.3.15	20.3.15
@angular/compiler	npm	>= 19.0.0-next.0, < 19.2.17	19.2.17
@angular/compiler	npm	<= 18.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability consists of two distinct vectors: a failure to sanitize URL-holding attributes in SVG and MathML, and a lack of validation for dynamic bindings to the attributeName attribute on SVG animation elements. The analysis of the patch commit 1c6b0704fb63d051fab8acff84d076abfbc4893a reveals the runtime functions involved in mitigating these issues.

For the first vector (insecure URL attributes), the patch modifies the compiler's SECURITY_SCHEMA to correctly classify a wide range of SVG and MathML attributes (like xlink:href) as requiring URL sanitization. This change ensures that the compiler generates code that funnels any value bound to these attributes through the ɵɵsanitizeUrl function at runtime. This function inspects the URL and prevents javascript: payloads from executing. The vulnerability, therefore, was the absence of calls to ɵɵsanitizeUrl for these specific attributes.

For the second vector (attributeName binding), the patch introduces a new runtime validation function, ɵɵvalidateAttribute. The compiler schema was updated to identify attributeName on elements like <animate> as a security-sensitive attribute that cannot be dynamically bound. This triggers the compiler to insert a call to ɵɵvalidateAttribute in the generated template code. At runtime, this function checks for the forbidden binding and throws an error, effectively blocking the exploit path. Before this function was introduced, no runtime check was performed, allowing the attack to succeed.

Consequently, ɵɵsanitizeUrl and the newly added ɵɵvalidateAttribute are the key runtime functions that process the malicious input and enforce the security policy that was previously missing.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.