Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1280382 > unrolled thread
| Started by | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| First post | 2026-02-01 11:00 +0100 |
| Last post | 2026-02-01 11:00 +0100 |
| Articles | 1 — 1 participant |
Back to article view | Back to linux.debian.bugs.dist
Bug#1126775: angular.js: CVE-2025-66412 Salvatore Bonaccorso <carnil@debian.org> - 2026-02-01 11:00 +0100
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2026-02-01 11:00 +0100 |
| Subject | Bug#1126775: angular.js: CVE-2025-66412 |
| Message-ID | <MjCpj-eUTR-7@gated-at.bofh.it> |
Source: angular.js
Version: 1.8.3-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for angular.js.
Note it is not clear if this affects as well the old version in
Debian, can you investigate?
CVE-2025-66412[0]:
| Angular is a development platform for building mobile and desktop
| web applications using TypeScript/JavaScript and other languages.
| Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting
| (XSS) vulnerability has been identified in the Angular Template
| Compiler. It occurs because the compiler's internal security schema
| is incomplete, allowing attackers to bypass Angular's built-in
| security sanitization. Specifically, the schema fails to classify
| certain URL-holding attributes (e.g., those that could contain
| javascript: URLs) as requiring strict URL security, enabling the
| injection of malicious scripts. This vulnerability is fixed in
| 21.0.2, 20.3.15, and 19.2.17.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-66412
https://www.cve.org/CVERecord?id=CVE-2025-66412
[1] https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49
[2] https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Back to top | Article view | linux.debian.bugs.dist
csiph-web