Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1280382

Bug#1126775: angular.js: CVE-2025-66412

Show all headers | View raw

Source: angular.js
Version: 1.8.3-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for angular.js.

Note it is not clear if this affects as well the old version in
Debian, can you investigate?

CVE-2025-66412[0]:
| Angular is a development platform for building mobile and desktop
| web applications using TypeScript/JavaScript and other languages.
| Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting
| (XSS) vulnerability has been identified in the Angular Template
| Compiler. It occurs because the compiler's internal security schema
| is incomplete, allowing attackers to bypass Angular's built-in
| security sanitization. Specifically, the schema fails to classify
| certain URL-holding attributes (e.g., those that could contain
| javascript: URLs) as requiring strict URL security, enabling the
| injection of malicious scripts. This vulnerability is fixed in
| 21.0.2, 20.3.15, and 19.2.17.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-66412
    https://www.cve.org/CVERecord?id=CVE-2025-66412
[1] https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49
[2] https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#1126775: angular.js: CVE-2025-66412 Salvatore Bonaccorso <carnil@debian.org> - 2026-02-01 11:00 +0100

csiph-web