Loading story…
A high-severity vulnerability, tracked as CVE-2025-66412, has been discovered in the Angular framework, allowing stored cross-site scripting (XSS) attacks through SVG animation, SVG URL, and MathML attributes. The flaw exists in the Angular Template Compiler, where the internal security schema fails to properly classify certain URL-holding attributes as requiring strict URL security, enabling attackers to inject malicious scripts that bypass Angular's built-in sanitization. This vulnerability affects Angular versions prior to 21.0.2, 20.3.15, and 19.2.17, and has been addressed in these subsequent releases.
Attackers exploiting this vulnerability can persistently inject malicious JavaScript into web applications built with vulnerable Angular versions, potentially compromising user data and session integrity. Organizations using Angular are strongly advised to update to the fixed versions to mitigate the risk of exploitation. The vulnerability is remotely exploitable and has been rated as high severity, with a CVSS 4.0 score of 8.5, underscoring the urgency for prompt remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A public vulnerability report described CVE-2025-66412 as a high-severity Angular flaw that allows stored XSS by bypassing sanitization through SVG and MathML-related vectors. The reporting reiterated the vulnerability's impact and exploit path but did not introduce a separate new incident.
Angular addressed CVE-2025-66412, a high-severity stored XSS vulnerability in the Template Compiler caused by incomplete security schema handling for certain SVG, SVG URL, and MathML attributes. The issue was fixed in versions 21.0.2, 20.3.15, and 19.2.17, with earlier versions affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple newly reported **cross-site scripting (XSS)** vulnerabilities affect unrelated software products, including **SiYuan**, **Angular**, and **@leanprover/unicode-input-component**. In SiYuan, incomplete SVG sanitization can let an unauthenticated attacker deliver a crafted URL that executes arbitrary JavaScript in the application's origin, enabling theft of session tokens, cookies, and API keys, as well as unauthorized access to notes, document contents, and configuration data. In Electron-based deployments, the impact may escalate to **remote code execution** if insecure web preferences such as `nodeIntegration` are enabled or `contextIsolation` is disabled. Angular disclosed a separate XSS flaw, tracked as **CVE-2026-32635**, caused by a sanitization bypass involving internationalized security-sensitive attributes such as `href` when combined with untrusted data binding; fixed versions include `22.0.0-next.3`, `21.2.4`, `20.3.18`, and `19.2.20`. A third, distinct issue, **CVE-2026-32732**, affects **@leanprover/unicode-input-component** and allows arbitrary JavaScript execution in a victim's browser session, potentially enabling session abuse, data access, and unauthorized backend requests. These are separate vulnerability disclosures rather than a single coordinated incident, and the content is substantive security reporting rather than fluff.
Jun 29, 2026
A high-severity vulnerability in the **Angular Language Service** extension for Visual Studio Code, tracked as **`CVE-2026-50178`**, allows remote code execution when malicious JSDoc content is rendered inside hover tooltips. The flaw stems from the extension treating tooltip Markdown as trusted while the Angular Language Server forwards insufficiently sanitized JSDoc-derived content, including brackets, raw links, and control characters. An attacker can embed a crafted `command:` URI in a project file or a third-party npm dependency so that, when a developer hovers over the affected symbol and clicks the link, VS Code executes commands on the developer’s host machine. The issue affects **`Angular.ng-template`** versions prior to **`21.2.4`** and can bypass normal **Restricted Mode** and **Workspace Trust** protections in VS Code. GitHub’s advisory says the bug was discovered and reported by **CodeMender from Google DeepMind**, and the published **CVSS 4.0** base score is **8.7**. Users are advised to upgrade the extension to **version `21.2.4` or later** to remediate the vulnerability.
Jun 29, 2026
A high-severity vulnerability in Angular's `@angular/common/http` package allows semantically different `HttpClient` requests to collide on the same `HttpTransferCache` key during Server-Side Rendering and client-side hydration, enabling cross-request response reuse and client-side state poisoning. The flaw, tracked as **CVE-2026-68945**, stems from ambiguous query-parameter serialization in cache-key generation, including cases where repeated parameters are comma-joined or attacker-controlled delimiters such as `&` and `=` produce identical serialized forms. The issue is remotely exploitable without authentication and carries a **CVSS 4.0 score of 8.8**. Angular fixed the bug by replacing custom serialization logic with native `URLSearchParams` sorting and encoding, and released patched versions **20.3.27**, **21.2.19**, and **22.0.2**; versions prior to those releases are affected. Public references include Angular commits, a pull request, and a GitHub security advisory documenting the remediation.
Aug 3, 2026