8.5
Élevée
CVE-2025-66412 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| angular 18.2 | premières → 18.2.14 | Pas de correctif indiqué |
| RUGGEDCOM RST2428P 4.0 | premières → < 4.0 | 4.0 |
| SIDIS Prime 4.0 | premières → < 4.0.800 | 4.0.800 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de angular
Les 38 CVE de angular →
CVE-2026-111753
Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
5.9
Moyenne
CVE-2026-111751
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
8.2
Élevée
CVE-2026-111754
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
5.1
Moyenne
CVE-2026-111752
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other…
8.2
Élevée