CVE-2026-52725
Published:June 22, 2026
Updated:October 14, 2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as "svg:script" (svg:script)). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Affected Packages
https://github.com/angular/angular.git (GITHUB):
Affected version(s) >=v20.3.16 <v20.3.22Fix Suggestion:
Update to version v20.3.22https://github.com/angular/angular.git (GITHUB):
Affected version(s) >=v21.0.4 <v21.2.15Fix Suggestion:
Update to version v21.2.15https://github.com/angular/angular.git (GITHUB):
Affected version(s) >=v19.2.18 <v19.2.23Fix Suggestion:
Update to version v19.2.23@angular/core (NPM):
Affected version(s) >=19.2.0 <19.2.25-angular-19.2.31Fix Suggestion:
Update to version 19.2.25-angular-19.2.31@angular/core (NPM):
Affected version(s) >=16.2.0 <16.2.12-angular-16.2.24Fix Suggestion:
Update to version 16.2.12-angular-16.2.24@angular/core (NPM):
Affected version(s) >=5.2.0 <5.2.11-angular-5.2.21Fix Suggestion:
Update to version 5.2.11-angular-5.2.21@angular/core (NPM):
Affected version(s) >=19.0.0-next.0 <19.2.23Fix Suggestion:
Update to version 19.2.23@angular/core (NPM):
Affected version(s) >=6.1.0 <6.1.10-angular-6.1.22Fix Suggestion:
Update to version 6.1.10-angular-6.1.22@angular/core (NPM):
Affected version(s) =14.3.0 <14.3.0-angular-14.3.13Fix Suggestion:
Update to version 14.3.0-angular-14.3.13@angular/core (NPM):
Affected version(s) >=8.2.0 <8.2.14-angular-8.2.26Fix Suggestion:
Update to version 8.2.14-angular-8.2.26@angular/core (NPM):
Affected version(s) >=18.2.0 <18.2.14-angular-18.2.24Fix Suggestion:
Update to version 18.2.14-angular-18.2.24@angular/core (NPM):
Affected version(s) >=12.2.0 <12.2.17-angular-12.3.10Fix Suggestion:
Update to version 12.2.17-angular-12.3.10@angular/core (NPM):
Affected version(s) >=17.3.0 <17.3.12-angular-17.3.24Fix Suggestion:
Update to version 17.3.12-angular-17.3.24@angular/core (NPM):
Affected version(s) >=10.2.0 <10.2.5-angular-10.2.20Fix Suggestion:
Update to version 10.2.5-angular-10.2.20@angular/core (NPM):
Affected version(s) >=21.0.0-next.0 <21.2.15Fix Suggestion:
Update to version 21.2.15@angular/core (NPM):
Affected version(s) >=20.0.0-next.0 <20.3.22Fix Suggestion:
Update to version 20.3.22@angular/core (NPM):
Affected version(s) >=15.2.0 <15.2.10-angular-15.2.22Fix Suggestion:
Update to version 15.2.10-angular-15.2.22@angular/core (NPM):
Affected version(s) >=4.4.0 <4.4.7-angular-4.4.16Fix Suggestion:
Update to version 4.4.7-angular-4.4.16@angular/core (NPM):
Affected version(s) >=9.1.0 <9.1.13-angular-9.1.26Fix Suggestion:
Update to version 9.1.13-angular-9.1.26@angular/core (NPM):
Affected version(s) >=7.2.0 <7.2.16-angular-7.2.27Fix Suggestion:
Update to version 7.2.16-angular-7.2.27@angular/core (NPM):
Affected version(s) =13.4.0 <13.4.0-angular-13.4.15Fix Suggestion:
Update to version 13.4.0-angular-13.4.15@angular/core (NPM):
Affected version(s) >=11.2.0 <11.2.14-angular-11.2.28Fix Suggestion:
Update to version 11.2.14-angular-11.2.28Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS
Base Score:
0.40