Stored cross-site scripting in Angular - #VU118873
Published: December 1, 2025
Vulnerability identifier: #VU118873
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Angular Template Compiler. A remote user can use SVG animation elements, SVG URL or MathML attributes to permanently inject and execute arbitrary JavaScript code in victim's browser.
Affected software
Angular
Remediation
Install updates from vendor's website.
Angular - addressed in versions 19.2.17, 20.3.15, 21.0.2