6.1

CVE-2026-52725

Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Angular ≫ Angular SwPlatform node.js Version <= 18.2.14
Angular ≫ Angular SwPlatform node.js Version >= 19.0.0 < 19.2.23
Angular ≫ Angular SwPlatform node.js Version >= 20.0.0 < 20.3.22
Angular ≫ Angular SwPlatform node.js Version >= 21.0.0 < 21.2.15
Angular ≫ Angular Version 22.0.0 Update next0 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next1 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next10 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next11 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next12 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next2 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next3 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next4 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next5 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next6 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next7 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next8 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update next9 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update rc0 SwPlatform node.js
Angular ≫ Angular Version 22.0.0 Update rc1 SwPlatform node.js
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.145
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security-advisories@github.com 5.3 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/angular/angular/pull/68686
Patch
Issue Tracking
https://github.com/angular/angular/pull/68713
Issue Tracking
https://github.com/angular/angular/security/advisories/GHSA-692r-grfm-v8x7
Third Party Advisory