CVE-2025-66412: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

Medium severity · published Dec 1, 2025

CVE-2025-66412

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

5.4

CVSS

0.4%

EPSS

On KEV

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 35% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

angular · angular

>= 21.0.0-next.0 < 21.0.2; >= 20.0.0-next.0 < 20.3.15; >= 19.0.0-next.0 < 19.2.17; <= 18.2.14 · source: vendor, NVD

RUGGEDCOM RST2428P · Siemens

before V4.0 · source: CISA

SIDIS Prime · Siemens

before V4.0.800 · source: CISA

In the news

VulnerabilityCritical

Siemens SIDIS Prime

View CSAF Summary SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version. The following versions of Siemens SIDIS Prime are affected: SIDIS Prime vers:intdot/<4.0.800 (CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-41996, CVE-2025-6965, CVE-2025-7783, CVE-2025-9230, CVE-2025-9232, CVE-2025-9670, CVE-2025-12816, CVE-2025-15284, CVE-2025-58751, CVE-2025-58752, CVE-2025-58754, CVE-2025-62522, CVE-2025-64718, CVE-2025-64756, CVE-2025-66030, CVE-2025-66031, CVE-2025-66035, CVE-2025-66412, CVE-2025-69277, CVE-2026-22610) CVSS Vendor Equipment Vulnerabilities v3 8.7 Siemens Siemens SIDIS Prime Out-of-bounds Read, Observable Discrepancy, Improper Input Validation, Improper Certificate Validation, Numeric Truncation Error, Use of Insufficiently Random Values, Out-of-bounds Write, Inefficient Regular Expression Complexity, Interpretation Conflict, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Relative Path Traversal, Allocation of Resources Without Limits or Throttling, Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Integer Overflow or Wraparound, Uncontrolled Recursio...

CVE-2024-29857 CVE-2024-30171 CVE-2024-30172

Mar 12, 2026·CISA Advisories

Affected product

angular

All angular CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-66412

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-66412

Patch

https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a

Third Party Advisory

https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-253495.html

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-485750.html