Angular Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-52725 - Vulnerability Database

Angular

Angular Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-52725

Medium

Reference: CVE-2026-52725

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-52725

Title: Angular Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2 21.2.15 20.3.22 and 19.2.23 an issue in the angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a ltscriptgt or namespaced script element (such as ltsvg:scriptgt). This enabled the initialization of custom components on a tag that executes scripts allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a ltscriptgt tag leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2 21.2.15 20.3.22 and 19.2.23.