Angular Platform Vulnerability Lets Attackers Execute Code Through Malicious SVG Animations

The Angular team has released high security updates to address a high-severity vulnerability in the Angular Template Compiler.

Tracked as CVE-2025-66412, this flaw allows attackers to bypass built-in security protections and execute malicious code inside a user’s browser.

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue. It stems from an incomplete security schema within the Angular compiler.

Metric	Details
CVE ID	CVE-2025-66412
Severity	High (CVSS 8.5)
Vulnerability Type	Stored XSS via SVG Animation

By default, Angular automatically “sanitizes” untrusted data to prevent hackers from injecting malicious scripts.

However, this newly discovered flaw reveals a blind spot in the framework’s handling of specific SVG (Scalable Vector Graphics) animation and MathML attributes.

How the Attack Works

The core of the problem lies in SVG animation elements, such as <animate> or <set>. These elements use an attribute called attributeName to define which property of an image should be animated.

The vulnerability exists because the compiler did not correctly validate this attributeName field.

An attacker can exploit this by binding the attributeName to a sensitive field like “href” (the standard link attribute).

Once the animation targets the “href” attribute, the attacker can inject a JavaScript URL into the animation’s value.

Because the compiler fails to recognize this specific combination as dangerous, it skips the usual security sanitization.

When a user interacts with the compromised element, such as clicking it or even automatically if the animation is set to trigger on its own, the malicious JavaScript executes.

If exploited, this vulnerability gives attackers complete control within the context of the victim’s session. The consequences are severe:

• Session Hijacking: Attackers can steal authentication tokens and cookies, effectively locking users out of their accounts.
• Data Theft: Sensitive user data displayed on the page can be captured and sent to external servers.
• Unauthorized Actions: The script can perform actions on the website as if the actual user were performing them.

The vulnerability affects multiple major versions of the @angular/compiler package. The Angular team has acted quickly, releasing patches for versions 19, 20, and 21.

Notably, versions 18 and older are listed as having “none” for patched versions in this advisory, suggesting users on older branches strictly need to upgrade.

Developers are strongly urged to update to the latest patched versions immediately (v19.2.17, v20.3.15, or v21.0.2).

For teams unable to upgrade instantly, strict workarounds are required. You must ensure that no untrusted data (from APIs or databases) is ever bound to SVG animation attributes.

Additionally, implementing a robust Content Security Policy (CSP) that strictly blocks JavaScript: URLs can effectively neutralize the attack vector even if the vulnerability remains in the code.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.