5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52725

CVE-2026-52725: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as svg:script). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52725

CVE-2026-52725:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/core	npm	>= 21.0.0-next.0, < 21.2.15	21.2.15
@angular/core	npm	>= 22.0.0-next.0, < 22.0.0-rc.2	22.0.0-rc.2
@angular/core	npm	>= 19.0.0-next.0, < 19.2.22	19.2.23
@angular/core	npm	<= 18.2.14
@angular/core	npm	>= 20.0.0-next.0, < 20.3.22	20.3.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the dynamic component creation process within Angular Core. The createComponent function allows developers to create and mount components at runtime. This function internally calls locateHostElement to resolve the DOM element that will host the new component.

The root cause of the vulnerability is in the locateHostElement function (located in packages/core/src/render3/instructions/shared.ts). Before the patch, this function did not check if the resolved host element was a <script> tag. An attacker able to control the input to createComponent (specifically the hostElement or a selector that resolves to a script tag) could force an Angular component to be mounted inside a <script> or <svg:script> element. This would cause the browser to interpret the component's template or content as executable JavaScript, leading to a Cross-Site Scripting (XSS) vulnerability.

The fix, applied in commit 3cd005ec2d19b187fdb686b424fffe2c89214338, introduces a check within locateHostElement to explicitly throw an error if the host element is a <script> tag, thus preventing the component from being mounted and mitigating the XSS risk. While createComponent is the user-facing API, the vulnerable logic resided within locateHostElement.

Vulnerable functions

locateHostElement

packages/core/src/render3/instructions/shared.ts

This function is responsible for resolving the host element for dynamic component creation. Prior to the patch, it did not validate the element's tag name, allowing a `<script>` or `<svg:script>` element to be used as a component host. This would lead to the component's template being rendered inside a script tag, causing a Cross-Site Scripting (XSS) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.