High-Severity Angular Flaw (CVE-2025-66412) Allows Stored XSS via SVG and MathML Bypass

CVE-2025-66412 is a high-severity flaw in Angular that allows stored XSS via exploitation of SVG and MathML attributes, with a CVSS score of 8.5. The vulnerability stems from the compiler’s internal security schema being incomplete, allowing attackers to bypass Angular’s built-in sanitization, according to GHSA-v4hv-rgfq-gp49. Specifically, certain URL-holding attributes in SVG (such as xlink:href) and MathML (such as math | href) were not strictly validated, enabling injection of malicious scripts.

Attackers can abuse SVG animation elements like <animate>, <set>, and <animateMotion> through the attributeName attribute to dynamically assign a javascript: URL to a target attribute, resulting in code execution in the application's origin on user interaction or during animations. Because this is a Stored XSS vulnerability, the payload can be saved on the server and later served to victims, potentially enabling session hijacking, data exfiltration, and unauthorized actions.

The Angular team has issued patches across versions 19.2.17, 20.3.15 and 21.0.2, and organisations are advised to enforce strict input hygiene and consider a robust CSP to disallow javascript: URLs if upgrade cannot be immediate.