Angular Platform Vulnerability Allows Malicious Code Execution Via Weaponized SVG Animation Files

A critical Stored XSS vulnerability in Angular’s template compiler (CVE-2025-66412) allows attackers to execute arbitrary code by weaponizing SVG animation attributes. Bypassing Angular’s built-in security sanitization mechanisms and affecting applications using versions below 19.2.17, 20.3.15, or 21.0.2. The Angular template compiler includes an incomplete security schema that fails to classify and sanitize URL-holding attributes and […]

The post Angular Platform Vulnerability Allows Malicious Code Execution Via Weaponized SVG Animation Files appeared first on Cyber Security News.