Angular Platform Vulnerability Allows Malicious Code Execution Via Weaponized SVG Animation Files

A critical Stored Cross-Site Scripting (XSS) vulnerability in Angular's template compiler, identified as CVE-2025-66412, enables attackers to execute arbitrary code by exploiting SVG animation attributes.

This vulnerability bypasses Angular's built-in security sanitization mechanisms and affects applications using versions below 19.2.17, 20.3.15, or 21.0.2.

The Angular template compiler has an incomplete security schema that fails to properly classify and sanitize URL-holding attributes and SVG animation elements.

The flaw is due to the compiler's inability to recognize specific URL-holding attributes, such as xlink:href and href , within SVG animation elements ( <animate> , <set> , <animateMotion> , <animateTransform> ).

Attackers can exploit this by binding untrusted data to the attributeName attribute of SVG animations, directing it to sensitive properties like href or xlink:href , and injecting a JavaScript URL payload.

Malicious code executes when the element is triggered through user interaction or automatically via animation timing.

Field Value

CVE ID CVE-2025-66412

Component @angular/compiler (npm)

Vulnerability Type Stored Cross-Site Scripting (XSS)

CVSS Score 8.6/10

Severity High

Attack Vector Network

When template bindings assign untrusted, user-controlled data to vulnerable attributes, the compiler incorrectly allows dangerous attribute assignments to pass validation.

Successful exploitation permits attackers to execute arbitrary code within the vulnerable application's domain, leading to session hijacking, data exfiltration, and unauthorized actions.

The attack requires that the Angular application render untrusted input, binding it to vulnerable attributes or SVG animation properties. The victim must interact with the compromised element or the animation must trigger automatically.

Organizations are advised to upgrade to patched versions: Angular 19.2.17, 20.3.15, or 21.0.2, as per the GitHub advisory .

For Angular 18.x users, implementing robust Content Security Policy (CSP) headers that disallow JavaScript: URLs is recommended as mitigation. Auditing template bindings to ensure untrusted data does not flow to vulnerable SVG/MathML attributes is also advised.

Based on reporting by Cyber Security News.