{ "affected": [ { "ranges": [ { "database_specific": { "cpe": [ "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:*" ], "extracted_events": [ { "introduced": "0" }, { "last_affected": "18.2.14" }, { "introduced": "19.0.0" }, { "fixed": "19.2.23" }, { "introduced": "20.0.0" }, { "fixed": "20.3.22" }, { "introduced": "21.0.0" }, { "fixed": "21.2.15" }, { "introduced": "22.0.0-next0" }, { "last_affected": "22.0.0-next0" }, { "introduced": "22.0.0-next1" }, { "last_affected": "22.0.0-next1" }, { "introduced": "22.0.0-next10" }, { "last_affected": "22.0.0-next10" }, { "introduced": "22.0.0-next11" }, { "last_affected": "22.0.0-next11" }, { "introduced": "22.0.0-next12" }, { "last_affected": "22.0.0-next12" }, { "introduced": "22.0.0-next2" }, { "last_affected": "22.0.0-next2" }, { "introduced": "22.0.0-next3" }, { "last_affected": "22.0.0-next3" }, { "introduced": "22.0.0-next4" }, { "last_affected": "22.0.0-next4" }, { "introduced": "22.0.0-next5" }, { "last_affected": "22.0.0-next5" }, { "introduced": "22.0.0-next6" }, { "last_affected": "22.0.0-next6" }, { "introduced": "22.0.0-next7" }, { "last_affected": "22.0.0-next7" }, { "introduced": "22.0.0-next8" }, { "last_affected": "22.0.0-next8" }, { "introduced": "22.0.0-next9" }, { "last_affected": "22.0.0-next9" } ], "source": [ "CPE_RANGE", "CPE_STRING" ] }, "events": [ { "introduced": "0" }, { "introduced": "e7566c3c475560616f97de2ab3c8f8d6f83be015" }, { "fixed": "7801eaac2ab43dc6983efc2d1692443c45f11a5f" }, { "introduced": "40e2b5b4d13792ed7c46a1d22afcf6c12ac9c679" }, { "fixed": "db20819ddc5dde871d8707d6cfbbe378f85795b5" }, { "introduced": "00dcbf2eeb3fd18ed39148e4bc9e49a5b35cae0c" }, { "fixed": "cea6588bb301c9a71fe703fd1cb3a2165fd768b4" }, { "introduced": "62676269d207db80576052d080b756e938be97ea" } ], "repo": "https://github.com/angular/angular", "type": "GIT" } ], "versions": [ "22.0.0-next0", "22.0.0-next1", "22.0.0-next10", "22.0.0-next11", "22.0.0-next12", "22.0.0-next2", "22.0.0-next3", "22.0.0-next4", "22.0.0-next5", "22.0.0-next6", "22.0.0-next7", "22.0.0-next8", "22.0.0-next9" ] } ], "aliases": [ "GHSA-692r-grfm-v8x7" ], "database_specific": { "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52725.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "\u003e= 22.0.0-next.0 \u003c 22.0.0-rc.2" }, { "last_affected": "\u003e= 22.0.0-next.0 \u003c 22.0.0-rc.2" }, { "introduced": "\u003e= 21.0.0-next.0 \u003c 21.2.15" }, { "last_affected": "\u003e= 21.0.0-next.0 \u003c 21.2.15" }, { "introduced": "\u003e= 20.0.0-next.0 \u003c 20.3.22" }, { "last_affected": "\u003e= 20.0.0-next.0 \u003c 20.3.22" }, { "introduced": "\u003e= 19.0.0-next.0 \u003c 19.2.22" }, { "last_affected": "\u003e= 19.0.0-next.0 \u003c 19.2.22" } ], "source": "AFFECTED_FIELD" } ] }, "details": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a \u003cscript\u003e or namespaced script element (such as \u003csvg:script\u003e). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a \u003cscript\u003e tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.", "id": "CVE-2026-52725", "modified": "2026-07-11T03:54:40.538806546Z", "published": "2026-06-22T15:18:43.036Z", "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52725.json" }, { "type": "ADVISORY", "url": "https://github.com/angular/angular/security/advisories/GHSA-692r-grfm-v8x7" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52725" }, { "type": "FIX", "url": "https://github.com/angular/angular/pull/68686" }, { "type": "FIX", "url": "https://github.com/angular/angular/pull/68713" } ], "schema_version": "1.7.5", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)" }