A critical Stored XSS vulnerability in Angular’s template compiler (CVE-2025-66412) allows attackers to execute arbitrary code by weaponizing SVG animation attributes.

Bypassing Angular’s built-in security sanitization mechanisms and affecting applications using versions below 19.2.17, 20.3.15, or 21.0.2.

The Angular template compiler includes an incomplete security schema that fails to classify and sanitize URL-holding attributes and SVG animation elements properly.

The vulnerability operates through two distinct attack vectors: unsafe URL attributes and dynamically manipulated SVG animation properties.

Weaponized SVG Animation Files

The flaw resides in the compiler’s inability to recognize specific URL-holding attributes (such as xlink:href and href).

SVG animation elements (

Attackers exploit this by binding untrusted data to the attributeName attribute of SVG animations, then pointing it to sensitive properties such as href or xlink:href. By injecting a JavaScript URL payload into the animation’s values or attributes.

Malicious code executes when the element is triggered either through user interaction or automatically via animation timing.

Field	Value
CVE ID	CVE-2025-66412
Component	@angular/compiler (npm)
Vulnerability Type	Stored Cross-Site Scripting (XSS)
CVSS Score	8.6/10
Severity	High
Attack Vector	Network

When template bindings assign untrusted, user-controlled data to vulnerable attributes. (e.g., [attr.xlink:href]=”maliciousURL” or

The compiler incorrectly falls back to non-sanitizing contexts, allowing the dangerous attribute assignment to pass validation.

Successful exploitation enables attackers to execute arbitrary code within the vulnerable application’s domain.

Leading to session hijacking through cookie and authentication token theft, data exfiltration of sensitive user information, and unauthorized actions performed on behalf of users.

The attack requires two preconditions: the Angular application must render untrusted input (from databases, APIs, or user submissions).

Bind it to vulnerable attributes or SVG animation properties, and the victim must either interact with the compromised element or the animation must trigger automatically.

Organizations must immediately upgrade to patched versions: Angular 19.2.17, 20.3.15, or 21.0.2, according to GitHub advisory.

For Angular 18.x users without a patch available, implementing robust Content Security Policy (CSP) headers that disallow JavaScript: URLs provides effective mitigation.

Until upgrades are deployed, teams should audit template bindings to ensure untrusted data never flows to vulnerable SVG/MathML attributes.

SVG animation attribute Name properties, and avoid dynamic binding of user-controlled data to these security-sensitive attributes.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Angular Platform Vulnerability Allows Malicious Code Execution Via Weaponized SVG Animation Files appeared first on Cyber Security News.