{"id":"EUVD-2025-200118","revision":"c187e4f55cec4bafab2fee98ae7ee3a3","records":[{"revision":"c187e4f55cec4bafab2fee98ae7ee3a3","observedAt":"2026-11-05T05:06:41.828+00:00","statement":{"source":"euvd","id":"EUVD-2025-200118","aliases":["CVE-2025-66412","GHSA-v4hv-rgfq-gp49"],"title":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified…","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5,"severity":null}],"references":["https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49","https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-200118","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 1, 2025, 10:35:59 PM","dateUpdated":"Jun 2, 2026, 1:00:31 PM"},"relatedAdvisories":[{"id":"SSA-485750","title":"SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62522","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610"]},{"id":"RHSA-2026:33371","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update","vulnerabilityIds":["CVE-2024-29371","CVE-2025-9784","CVE-2025-12543","CVE-2025-13465","CVE-2025-15284","CVE-2025-23184","CVE-2025-23368","CVE-2025-66412","CVE-2025-69873","CVE-2026-1002","CVE-2026-24842"]},{"id":"ICSA-26-188-05","title":"Siemens SINEC OS","vulnerabilityIds":["CVE-2025-1352","CVE-2025-1376","CVE-2025-6052","CVE-2025-6141","CVE-2025-6170","CVE-2025-7039","CVE-2025-8732","CVE-2025-9086","CVE-2025-9230","CVE-2025-9231","CVE-2025-9232","CVE-2025-10966","CVE-2025-13465","CVE-2025-13601","CVE-2025-39913","CVE-2025-40214","CVE-2025-40248","CVE-2025-40250","CVE-2025-40251","CVE-2025-40252","CVE-2025-40254","CVE-2025-40257","CVE-2025-40258","CVE-2025-40261","CVE-2025-40262","CVE-2025-40263","CVE-2025-40264","CVE-2025-40271","CVE-2025-40278","CVE-2025-40280","CVE-2025-40281","CVE-2025-40345","CVE-2025-46394","CVE-2025-49794","CVE-2025-49795","CVE-2025-49796","CVE-2025-60876","CVE-2025-66035","CVE-2025-66382","CVE-2025-66412","CVE-2025-69720","CVE-2025-71185","CVE-2025-71186","CVE-2025-71188","CVE-2025-71189","CVE-2025-71190","CVE-2025-71191","CVE-2026-1484","CVE-2026-1489","CVE-2026-3784","CVE-2026-22610","CVE-2026-22976","CVE-2026-22977","CVE-2026-23025","CVE-2026-23026","CVE-2026-23030","CVE-2026-23031","CVE-2026-23032","CVE-2026-23033","CVE-2026-23037","CVE-2026-23038","CVE-2026-23111","CVE-2026-23112","CVE-2026-23220","CVE-2026-23222","CVE-2026-23228","CVE-2026-23229","CVE-2026-23230","CVE-2026-23231","CVE-2026-23236","CVE-2026-23238","CVE-2026-24515","CVE-2026-25210","CVE-2026-26157","CVE-2026-26158","CVE-2026-35535","CVE-2026-41918"]},{"id":"SSA-253495","title":"SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0","vulnerabilityIds":["CVE-2025-1352","CVE-2025-1376","CVE-2025-6052","CVE-2025-6141","CVE-2025-6170","CVE-2025-7039","CVE-2025-8732","CVE-2025-9086","CVE-2025-9230","CVE-2025-9231","CVE-2025-9232","CVE-2025-10966","CVE-2025-13465","CVE-2025-13601","CVE-2025-39913","CVE-2025-40214","CVE-2025-40248","CVE-2025-40250","CVE-2025-40251","CVE-2025-40252","CVE-2025-40254","CVE-2025-40257","CVE-2025-40258","CVE-2025-40261","CVE-2025-40262","CVE-2025-40263","CVE-2025-40264","CVE-2025-40271","CVE-2025-40278","CVE-2025-40280","CVE-2025-40281","CVE-2025-40345","CVE-2025-46394","CVE-2025-49794","CVE-2025-49795","CVE-2025-49796","CVE-2025-60876","CVE-2025-66035","CVE-2025-66382","CVE-2025-66412","CVE-2025-69720","CVE-2025-71185","CVE-2025-71186","CVE-2025-71188","CVE-2025-71189","CVE-2025-71190","CVE-2025-71191","CVE-2026-1484","CVE-2026-1489","CVE-2026-3784","CVE-2026-22610","CVE-2026-22976","CVE-2026-22977","CVE-2026-23025","CVE-2026-23026","CVE-2026-23030","CVE-2026-23031","CVE-2026-23032","CVE-2026-23033","CVE-2026-23037","CVE-2026-23038","CVE-2026-23111","CVE-2026-23112","CVE-2026-23220","CVE-2026-23222","CVE-2026-23228","CVE-2026-23229","CVE-2026-23230","CVE-2026-23231","CVE-2026-23236","CVE-2026-23238","CVE-2026-24515","CVE-2026-25210","CVE-2026-26157","CVE-2026-26158","CVE-2026-35535","CVE-2026-41918"]},{"id":"WID-SEC-W-2025-2708","title":"Angular: Schwachstelle ermöglicht Cross-Site Scripting","vulnerabilityIds":["CVE-2025-66412"]},{"id":"NCSC-2026-0079","title":"Kwetsbaarheden verholpen in Siemens producten","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-27769","CVE-2025-40943","CVE-2025-55018","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62439","CVE-2025-62522","CVE-2025-64157","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610","CVE-2026-24858","CVE-2026-25569","CVE-2026-25570","CVE-2026-25571","CVE-2026-25572","CVE-2026-25573","CVE-2026-25605"]},{"id":"ICSA-26-071-03","title":"Siemens SIDIS Prime","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62522","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610"]},{"id":"RHSA-2026:86618","title":"Red Hat Security Advisory: New container image: rhceph-9.2","vulnerabilityIds":["CVE-2023-46159","CVE-2024-47866","CVE-2024-48916","CVE-2024-55565","CVE-2025-12816","CVE-2025-15599","CVE-2025-26791","CVE-2025-30156","CVE-2025-50181","CVE-2025-50182","CVE-2025-58754","CVE-2025-59343","CVE-2025-62718","CVE-2025-66030","CVE-2025-66035","CVE-2025-66412","CVE-2025-69873","CVE-2026-0540","CVE-2026-21441","CVE-2026-22610","CVE-2026-25639","CVE-2026-26996","CVE-2026-27903","CVE-2026-27904","CVE-2026-27970","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33672","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39865","CVE-2026-40175","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-42033","CVE-2026-42034","CVE-2026-42035","CVE-2026-42036","CVE-2026-42037","CVE-2026-42038","CVE-2026-42039","CVE-2026-42040","CVE-2026-42041","CVE-2026-42042","CVE-2026-42043","CVE-2026-42044","CVE-2026-50152","CVE-2026-58224"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-200118","identifiers":["EUVD-2025-200118","CVE-2025-66412","GHSA-v4hv-rgfq-gp49"]},"retained":false,"historicalAffected":[]}],"coverage":[]}